EUVD-2025-209804
GHSA-c3gv-678x-vgc9
Severity by source
AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
A use of potentially dangerous function vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.4, FortiAnalyzer 7.4.0 through 7.4.8, FortiAnalyzer 7.2 all versions, FortiAnalyzer 7.0 all versions, FortiAnalyzer 6.4 all versions, FortiManager 7.6.0 through 7.6.4, FortiManager 7.4.0 through 7.4.8, FortiManager 7.2 all versions, FortiManager 7.0 all versions, FortiManager 6.4 all versions may allow an authenticated attacker to cause a system hang via multiple specially crafted HTTP requests causing crashes. This happens if internal locks are aligned, which is out of control of the attacker.
AnalysisAI
Denial-of-service attacks against Fortinet FortiAnalyzer and FortiManager 6.4 through 7.6.4 allow authenticated attackers to trigger system hangs via specially crafted HTTP requests that exploit a use of potentially dangerous function vulnerability (CWE-676). The crash occurs only when internal lock alignment conditions are met, making exploitation dependent on timing and system state rather than attacker control. CVSS 5.2 reflects medium severity with high attack complexity and low availability impact; active exploitation is not confirmed.
Technical ContextAI
The vulnerability stems from improper use of dangerous functions in the HTTP request handling code of FortiAnalyzer and FortiManager management appliances. CWE-676 identifies functions that may be unsafe or deprecated in the codebase, likely related to unsafe memory operations, buffer handling, or synchronization primitives. The root cause involves race conditions or deadlock scenarios triggered when multiple HTTP requests interact with internal locking mechanisms. The vulnerability manifests as a denial of service through system hangs rather than memory corruption or code execution, suggesting the dangerous function call leads to resource exhaustion or infinite loops under specific concurrency conditions. Exploitation requires authentication (PR:L per CVSS vector), limiting attack surface to users with valid credentials.
RemediationAI
Apply the latest security patches from Fortinet for FortiAnalyzer and FortiManager. For FortiAnalyzer, upgrade to version 7.6.5 or later, 7.4.9 or later, or the latest patched releases for 7.2 and 7.0 series. For FortiManager, apply equivalent patches (7.6.5+, 7.4.9+, and patched versions of 7.2 and 7.0). Consult the Fortiguard advisory FG-IR-26-137 for exact patch version numbers and release dates. As an interim compensating control, restrict administrative access to FortiAnalyzer and FortiManager to a minimal set of trusted accounts and IP addresses through firewall rules and access control lists, reducing the pool of authenticated users who could trigger the vulnerability. Monitor system logs for unusual HTTP request patterns or repeated authentication attempts that might precede exploitation attempts. Disable non-essential HTTP/HTTPS access to management interfaces if not required for daily operations, though this may impact legitimate remote administration workflows. Note that these compensating controls do not prevent exploitation by authenticated insiders but significantly reduce the attack surface.
An authentication bypass using an alternate path or channel [CWE-288] in Fortinet FortiOS version 7.2.0 through 7.2.1 an
Fortinet FortiWeb contains a relative path traversal allowing unauthenticated attackers to execute administrative comman
FortiOS and FortiProxy contain an authentication bypass via the Node.js websocket module allowing unauthenticated remote
A out-of-bounds write in Fortinet FortiOS versions 7.4.0 through 7.4.2, 7.2.0 through 7.2.6, 7.0.0 through 7.0.13, 6.4.0
A heap-based buffer overflow vulnerability [CWE-122] in FortiOS version 7.2.4 and below, version 7.0.11 and below, versi
Fortinet FortiWeb contains an authenticated OS command injection allowing privilege escalation to execute unauthorized c
FortiOS SSL-VPN contains an improper authentication vulnerability that allows users to bypass two-factor authentication
Fortinet FortiAnalyzer before 5.0.12 and 5.2.x before 5.2.5; FortiSwitch 3.3.x before 3.3.3; FortiCache 3.0.x before 3.0
A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet a
Buffer overflow in the Cookie parser in Fortinet FortiOS 4.x before 4.1.11, 4.2.x before 4.2.13, and 4.3.x before 4.3.9
OS command injection in Fortinet FortiSandbox 4.4.0-4.4.8 and FortiSandbox PaaS versions 21.3-23.4 enables remote unauth
A product has a SQL injection vulnerability enabling unauthenticated database compromise through improperly neutralized
Same weakness CWE-676 – Use of Potentially Dangerous Function
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today