CVE-2025-64155
CRITICALCVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
3Description
An improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSIEM 7.4.0, FortiSIEM 7.3.0 through 7.3.4, FortiSIEM 7.1.0 through 7.1.8, FortiSIEM 7.0.0 through 7.0.4, FortiSIEM 6.7.0 through 6.7.10 may allow an attacker to execute unauthorized code or commands via crafted TCP requests.
Analysis
Fortinet FortiSIEM (6.7.0 through 7.4.0) has OS command injection via crafted TCP requests. As a SIEM, compromise gives attackers access to all security logs and the ability to suppress alerts. PoC available.
Technical Context
Crafted TCP requests inject OS commands (CWE-78) into the SIEM. Compromising a SIEM is particularly devastating because the attacker can suppress their own alerts, manipulate log data, and access all collected security telemetry.
Affected Products
FortiSIEM 7.4.0, 7.3.0-7.3.4, 7.1.0-7.1.8, 7.0.0-7.0.4, 6.7.0-6.7.10
Remediation
Apply Fortinet patches immediately. A compromised SIEM requires full incident response.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today