Fortianalyzer EUVD-2025-209453

Real-world risk is high despite requiring privileged authentication. The CVSS 7.2 score reflects a remotely exploitable vulnerability (AV:N) with low attack complexity (AC:L) that achieves full confidentiality, integrity, and availability impact (C:H/I:H/A:H) once high-privilege access is obtained (PR:H). While the PR:H requirement reduces immediate mass-exploitation risk, credential compromise of administrative accounts through phishing, credential stuffing, or insider threats is common in enterprise environments. The network attack vector means any authenticated admin on the network can exploit this without physical access. No public exploit identified at time of analysis and no CISA KEV listing indicates exploitation is not yet widespread. However, the target platforms (FortiAnalyzer/FortiManager) are high-value infrastructure managing security device fleets, making them attractive targets for advanced persistent threats. The ability to execute unauthorized code on centralized management systems could enable lateral movement, configuration tampering, or log manipulation across entire Fortinet deployments. SSVC assessment suggests high technical impact (arbitrary code execution) with medium exploitability (requires stolen credentials). Organizations should prioritize patching management infrastructure given the blast radius potential.

An attacker who has compromised high-privilege administrative credentials for a FortiManager or FortiAnalyzer instance sends specially crafted JSON RPC API requests containing SQL injection payloads. The vulnerable API fails to properly sanitize input parameters, allowing the attacker to manipulate backend SQL queries. By exploiting the injection point, the attacker executes arbitrary database commands to extract sensitive configuration data, modify security policies across managed devices, or leverage database functionality to achieve code execution on the management server itself. With control of the centralized management platform, the attacker can pivot to managed FortiGate firewalls, disable logging to cover tracks, or establish persistent backdoor access across the entire Fortinet infrastructure.