What is the CVSS score of EUVD-2025-17797?

EUVD-2025-17797 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Fortiadc are affected by EUVD-2025-17797?

FortiADC load balancers running versions 6.1 through 7.6.1 are vulnerable to authenticated command injection attacks that could allow internal users or compromised accounts to execute arbitrary code.

How to fix or mitigate EUVD-2025-17797?

Within 24 hours: Inventory all FortiADC instances and document affected versions; restrict administrative access to FortiADC consoles to trusted networks and implement additional MFA where possible. Within 7 days: Deploy WAF rules to block suspicious HTTP payloads targeting command injection patterns; enable detailed audit logging for all FortiADC administrative actions and API calls. Within 30 days: Contact Fortinet for patch availability status; evaluate migration timeline to patched versions; conduct security review of all FortiADC administrative accounts and credential rotation.

Fortiadc EUVD-2025-17797

| CVE-2025-31104 HIGH

OS Command Injection (CWE-78)

2025-06-10 psirt@fortinet.com

Command Injection Fortinet Fortigate RCE Authentication Bypass Fortiadc

7.2

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.2 HIGH

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

EUVD ID Assigned

Mar 14, 2026 - 19:49 euvd

EUVD-2025-17797

Analysis Generated

Mar 14, 2026 - 19:49 vuln.today

CVE Published

Jun 10, 2025 - 17:21 nvd

HIGH 7.2

DescriptionCVE.org

An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability [CWE-78] in FortiADC 7.6.0 through 7.6.1, 7.4.0 through 7.4.6, 7.2.0 through 7.2.7, 7.1.0 through 7.1.4, 7.0 all versions, 6.2 all versions, 6.1 all versions may allow an authenticated attacker to execute unauthorized code via crafted HTTP requests.

AnalysisAI

FortiADC versions 6.1 through 7.6.1 contain an OS command injection vulnerability (CWE-78) that allows authenticated attackers with high privileges to execute arbitrary code through crafted HTTP requests. The vulnerability affects multiple product versions across several release branches, with a CVSS score of 7.2 indicating high severity. While the attack requires authentication and high-level privileges, successful exploitation results in complete system compromise with confidentiality, integrity, and availability impact.

Technical ContextAI

This vulnerability is an OS Command Injection flaw (CWE-78: Improper Neutralization of Special Elements used in an OS Command) in Fortinet's FortiADC application delivery controller. The affected component likely processes user-supplied input from HTTP requests that is subsequently passed to OS-level command execution functions without proper sanitization or parameterization. The vulnerability exists across the network security appliance's input validation layer, affecting the HTTP request processing pipeline. CWE-78 typically occurs when applications construct system commands using unsanitized user input, allowing attackers to inject shell metacharacters or command separators. The affected CPE scope includes FortiADC 6.1, 6.2, 7.0, 7.1.0-7.1.4, 7.2.0-7.2.7, 7.4.0-7.4.6, and 7.6.0-7.6.1, indicating the vulnerability has persisted across multiple major and minor versions.

RemediationAI

Patching: Upgrade FortiADC to patched versions. Based on typical Fortinet release patterns, users should upgrade to: FortiADC 7.6.2 or later (for 7.6.x branch), 7.4.7 or later (for 7.4.x branch), 7.2.8 or later (for 7.2.x branch), 7.1.5 or later (for 7.1.x branch), or current versions of 7.0 with security patches. FortiADC 6.x versions have reached end-of-life and should be replaced entirely.; priority: Critical Access Control: Restrict administrative access to FortiADC management interfaces. Implement network segmentation to limit which hosts can access management endpoints. Disable unnecessary administrative accounts and enforce MFA/2FA for administrative access.; priority: High Monitoring: Enable detailed logging of administrative actions and HTTP requests to the FortiADC management interface. Monitor logs for unusual command patterns, shell metacharacters in requests, or administrative activity from unexpected sources.; priority: High Workaround: Until patches can be applied, implement firewall rules to restrict HTTP/HTTPS access to FortiADC management interfaces to trusted administrative IP ranges only.; priority: Medium