FortiWeb
CVE-2025-64447
HIGH
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Network-reachable and unauthenticated (AV:N/PR:N), but the required prior knowledge of the serial number justifies AC:H; forged-cookie bypass grants full arbitrary operations, so C:H/I:H/A:H.
Primary rating from Vendor (fortinet).
CVSS VectorVendor: fortinet
Lifecycle Timeline
2DescriptionCVE.org
A reliance on cookies without validation and integrity checking vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.1, FortiWeb 7.6.0 through 7.6.5, FortiWeb 7.4.0 through 7.4.10, FortiWeb 7.2.0 through 7.2.11, FortiWeb 7.0.0 through 7.0.11 may allow an unauthenticated attacker to execute arbitrary operations on the system via crafted HTTP or HTTPS request via forged cookies, requiring prior knowledge of the FortiWeb serial number.
AnalysisAI
Unauthenticated remote attackers who already know a target FortiWeb appliance's serial number can forge a cookie that the device accepts without integrity checking, allowing arbitrary operations through a single crafted HTTP or HTTPS request. Affected releases are FortiWeb 8.0.0 through 8.0.1, 7.6.0 through 7.6.5, 7.4.0 through 7.4.10, 7.2.0 through 7.2.11, and 7.0.0 through 7.0.11; no public exploit code has been identified and the flaw is not listed in CISA KEV at time of analysis. CVSS 3.1 scores this 8.1 with AC:H solely because of the serial-number prerequisite, which narrows opportunistic mass exploitation but does not protect a targeted attacker who can obtain or enumerate the serial, so this remains a real priority despite that mitigating access-complexity factor.
Technical ContextAI
CWE-565 covers reliance on cookies without validation and integrity checking. FortiWeb's web/management interface issues cookies whose contents the appliance treats as trusted state, but the code fails to authenticate that state with a cryptographic signature or message authentication code. Because the appliance serial number is used as keying or checking material in the cookie logic, an attacker who knows the serial can construct a cookie that passes the appliance's checks and reaches an authenticated or otherwise privileged context. The weakness lives in the appliance's HTTP/HTTPS session handling, and the affected CPEs are all fortinet:fortiweb builds inside the listed version ranges. The assessed vector AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H confirms a network-reachable attack with no authentication and no user interaction, producing high confidentiality, integrity, and availability impact, with high attack complexity attributable entirely to the serial-number prerequisite.
RemediationAI
Fortinet published advisory FG-IR-25-945 at https://fortiguard.fortinet.com/psirt/FG-IR-25-945; consult it and upgrade each affected FortiWeb branch to the fixed release Fortinet documents there, avoiding reliance on version numbers not provided in this analysis. Patch status is best described as patch available per vendor advisory, since the exact fixed versions are not present in the input data. If immediate upgrade is not possible, restrict access to the FortiWeb management and web interface to trusted management networks or a VPN, because the attack requires network reachability to that interface; this may block legitimate remote administration and must be weighed against operational needs. Reduce exposure of the appliance serial number from unauthenticated pages, login responses, status endpoints, or APIs where possible, recognizing this is weak protection because serials are often legitimately disclosed in device output. Monitor for HTTP/HTTPS requests containing forged or malformed cookie headers aimed at the FortiWeb interface and correlate them with the serial-number disclosure channels described above.
Fortinet FortiWeb contains a relative path traversal allowing unauthenticated attackers to execute administrative comman
Fortinet FortiWeb contains an authenticated OS command injection allowing privilege escalation to execute unauthorized c
A improper handling of parameters in Fortinet FortiWeb versions 7.6.3 and below, versions 7.4.7 and below, versions 7.2.
Arbitrary file write and folder deletion in Fortinet FortiManager, FortiOS, and FortiProxy is possible via a path traver
A buffer underwrite ('buffer underflow') vulnerability in the administrative interface of Fortinet FortiOS version 7.2.0
An improper neutralization of input during web page generation in FortiWeb GUI interface 6.3.0 through 6.3.7 and version
Authentication bypass in Fortinet FortiWeb (versions 7.0.0-7.0.12, 7.2.0-7.2.12, 7.4.0-7.4.11, 7.6.0-7.6.6, and 8.0.0-8.
Authentication bypass in Fortinet FortiWeb 8.0.0, 7.6.0-7.6.4, and 7.4.0-7.4.9 allows unauthenticated remote attackers t
Multiple vulnerabilities in the authentication mechanism of confd in FortiWeb versions 6.4.1, 6.4.0, 6.3.0 through 6.3.1
A stack-based buffer overflow in Fortinet FortiWeb version 6.4.0, version 6.3.15 and below, 6.2.5 and below allows attac
Privilege escalation via path traversal affects multiple Fortinet appliances - FortiWeb (6.4, 7.0, 7.2, 7.4.0-7.4.4, 7.6
Cross-site request forgery (CSRF) vulnerability in Fortinet FortiWeb before 5.5.3 allows remote attackers to hijack the
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today