Fortianalyzer CVE-2025-68649

CVSS 6.0 with CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H indicates local attack vector, low complexity exploitation, and high-privilege requirement (PR:H). The integrity and availability impact is high because successful exploitation results in arbitrary file deletion, potentially affecting system stability, configuration integrity, and availability of the FortiAnalyzer/FortiManager service. However, real-world risk is constrained by the requirement for high-privilege (administrative) access-this is not an unprivileged-user-to-admin escalation, but rather a lateral movement or malicious-admin scenario. Organizations with strong access controls limiting CLI access to trusted administrators face lower practical risk. The absence of any KEV designation or public POC suggests this is not currently exploited in widespread attacks, though the straightforward nature of path traversal logic makes exploitation trivial once CLI access is obtained. This is a realistic but lower-priority vulnerability compared to unauthenticated remote code execution, suitable for standard patching cycles rather than emergency response.

A disgruntled systems administrator with CLI access to a FortiAnalyzer instance crafts a CLI delete command that includes path traversal sequences (e.g., 'delete ../../../etc/critical_config') to remove system files outside the intended management directory. Alternatively, an attacker who has compromised an administrative account via phishing or credential theft uses the same technique to disrupt service availability or corrupt system integrity. Because the CLI command processor does not validate path boundaries, the filesystem call executes with full privileges, deleting files the attacker specifies.