FortiOS FortiProxy CVE-2025-67862

Exploitation requires authenticated access as an administrator (PR:H per CVSS vector) with CLI access to the device - this is a local attack vector (AV:L), meaning the attacker must have interactive CLI or console-level access, not just network reachability to management ports. The specific condition enabling exploitation is the presence of an exposed Lua scripting debug capability reachable via crafted CLI commands; no special non-default configuration beyond a standard admin CLI session is described as required. Exploitation is limited by: (1) the requirement for high-privilege admin credentials, which are not obtained through this vulnerability itself; (2) local/CLI access vector, ruling out purely remote unauthenticated exploitation; and (3) no user interaction required once admin CLI access is established. The primary realistic attack scenarios are insider threat, post-compromise escalation after credential theft, or an attacker who has already pivoted to admin-level access and seeks to abuse debug capabilities to exceed intended administrative scope.

The CVSS base score of 6.0 (Medium) reflects the significant constraint of requiring high-privilege local access (AV:L/PR:H), which substantially limits attack surface compared to a typical RCE vulnerability. Despite the High impact ratings across confidentiality, integrity, and availability (C:H/I:H/A:H), these are conditional on an attacker who is already an authenticated administrator - a position that carries broad inherent access. The real-world priority is therefore primarily relevant in scenarios involving insider threats, compromised admin credentials, or post-compromise lateral movement where an attacker has obtained admin rights and seeks to expand capability or evade logging. The E:P temporal metric confirms a proof-of-concept exists, raising the urgency modestly - this is not purely theoretical. However, there is no CISA KEV listing and no indication of active exploitation campaigns. The RL:O (Official Remedy) indicator confirms Fortinet has released patches, making the risk window primarily relevant to unpatched deployments. EPSS score data was not provided in the source intelligence; exploitation probability should be considered low-to-moderate given the high privilege requirement but non-zero given POC availability.

An attacker who has compromised an administrator account - whether through credential theft, phishing, or insider access - authenticates to the FortiOS or FortiProxy CLI and issues specially crafted commands that invoke the exposed Lua scripting debug interface. Through this interface, the attacker executes Lua scripts at an elevated system level beyond standard administrative permissions, potentially reading sensitive configuration data, modifying firewall policies, or disrupting availability. A proof-of-concept demonstrating this technique exists, meaning the crafted CLI command syntax is not purely theoretical.