EUVD-2025-209450
GHSA-v55w-rvx7-pq26
Severity by source
AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Lifecycle Timeline
5DescriptionCVE.org
A missing authentication for critical function vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2.0 through 7.2.11, FortiOS 7.0.0 through 7.0.17, FortiOS 6.4 all versions, FortiOS 6.2.9 through 6.2.17 allows attacker to execute unauthorized code or commands via specially crafted packets.
AnalysisAI
Fortinet FortiOS allows unauthenticated remote attackers to execute arbitrary code or commands on affected devices through specially crafted packets due to missing authentication controls on a critical function. This affects FortiOS versions 6.2.9 through 6.2.17, all 6.4.x versions, 7.0.0 through 7.0.17, 7.2.0 through 7.2.11, 7.4.0 through 7.4.8, and 7.6.0 through 7.6.3. With a CVSS score of 6.5 and an adjacent network attack vector, this represents a significant risk to FortiGate appliances accessible from local network segments. No public exploit code or active exploitation has been confirmed at time of analysis.
Technical ContextAI
FortiOS is the operating system for Fortinet FortiGate firewalls and security appliances. The vulnerability stems from CWE-306 (Missing Authentication for Critical Function), indicating that a critical operational function lacks proper authentication validation before execution. The CVSS vector specifies an adjacent network attack vector (AV:A), meaning the attacker must be on the same local network segment as the target device, with no privilege requirements (PR:N) and no user interaction (UI:N). The vulnerability allows code or command execution with integrity impact (I:H), suggesting the attacker can modify system behavior or configuration. The affected CPE string (cpe:2.3:a:fortinet:fortios) encompasses all FortiOS installations across the specified version ranges, making this a broad-impact issue for Fortinet customers.
RemediationAI
Fortinet has released patched versions to address this vulnerability. Upgrade to FortiOS 6.2.18 or later for the 6.2.x branch, FortiOS 6.4.17 or later for the 6.4.x branch, FortiOS 7.0.18 or later for the 7.0.x branch, FortiOS 7.2.12 or later for the 7.2.x branch, FortiOS 7.4.9 or later for the 7.4.x branch, or FortiOS 7.6.4 or later for the 7.6.x branch. Organizations unable to patch immediately should restrict network access to FortiGate appliances by limiting connections from untrusted local network segments, implementing network segmentation to isolate management access, and monitoring authentication logs for suspicious activity. Consult Fortinet security advisory FG-IR-26-125 at https://fortiguard.fortinet.com/psirt/FG-IR-26-125 for detailed patch availability and deployment guidance.
Fortinet FortiWeb contains a relative path traversal allowing unauthenticated attackers to execute administrative comman
FortiOS and FortiProxy contain an authentication bypass via the Node.js websocket module allowing unauthenticated remote
Fortinet FortiWeb contains an authenticated OS command injection allowing privilege escalation to execute unauthorized c
Fortinet FortiAnalyzer before 5.0.12 and 5.2.x before 5.2.5; FortiSwitch 3.3.x before 3.3.3; FortiCache 3.0.x before 3.0
Buffer overflow in the Cookie parser in Fortinet FortiOS 4.x before 4.1.11, 4.2.x before 4.2.13, and 4.3.x before 4.3.9
OS command injection in Fortinet FortiSandbox 4.4.0-4.4.8 and FortiSandbox PaaS versions 21.3-23.4 enables remote unauth
A product has a SQL injection vulnerability enabling unauthenticated database compromise through improperly neutralized
Remote code execution in Fortinet FortiClientEMS versions 7.4.5 through 7.4.6 allows unauthenticated attackers to execut
Unauthenticated OS command injection in Fortinet FortiSandbox (on-premise, Cloud, and PaaS variants) allows remote attac
An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability [CWE-78] in
Fortinet FortiAnalyzer and FortiManager contain a critical authentication bypass vulnerability (CVE-2026-24858, CVSS 9.8
Authentication bypass in Fortinet FortiOS, FortiProxy, and FortiSwitchManager allows unauthenticated remote attackers to
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today