Fortinet FortiVoice CVE-2025-64156

Exploitation requires an authenticated attacker who already holds a privileged (administrative) account on the FortiVoice appliance (CVSS PR:H) - this is the primary limiting factor and rules out anonymous/unauthenticated exploitation. Given that access, the attacker sends crafted requests to an affected endpoint where user input is not neutralized before use in a SQL command (CWE-89), enabling execution of unauthorized code or commands. Affected deployments are FortiVoice 7.2.0 through 7.2.2, 7.0.0 through 7.0.7, all 6.4 versions, and all 6.0 versions; no user interaction (UI:N) and no special non-default configuration is indicated. The high privilege prerequisite means realistic risk is confined to insider abuse or post-credential-compromise escalation rather than mass remote exploitation.

The CVSS 3.1 base score of 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) reflects a network-reachable SQL injection with low attack complexity but a high privilege requirement (PR:H) - the attacker must already hold an authenticated, privileged administrative account on FortiVoice. This gating factor substantially reduces real-world risk: the flaw is not usable by an anonymous internet attacker but rather represents privilege abuse or a post-compromise escalation vector, where a privileged admin gains code/command execution (C:H/I:H/A:H) beyond the intended interface. No EPSS score, no CISA KEV listing, and no public POC were provided in the intelligence set, so there is no public exploit identified at time of analysis and no evidence of active exploitation. There is no SSVC decision data provided. The signals are internally consistent (vendor Fortinet PSIRT-issued, single advisory), with the main tension being that PR:H + no exploit signals point to this being a lower operational priority than the 'High' 7.2 score suggests in isolation - realistic priority is moderate, driven by Fortinet's brand exposure rather than by any confirmed exploitation. Note the description's phrase 'execute unauthorized code or commands' extends impact beyond pure data disclosure into command execution, which justifies the C:H/I:H/A:H triad for a CWE-89 issue.

An attacker who has obtained privileged administrative credentials on a FortiVoice appliance (via phishing, credential reuse, or an insider) sends crafted requests to a vulnerable administrative endpoint, injecting SQL that the backend fails to neutralize. Because the flaw permits execution of unauthorized code or commands, the attacker escalates from database manipulation to executing commands on the appliance, fully compromising the VoIP/PBX system. No public POC or exploit code was identified in the provided intelligence.