FortiOS FortiProxy EUVD-2025-210465

Exploitation requires two specific preconditions: first, the attacker must be in possession of a valid web filter override token issued by the FortiOS or FortiProxy instance - this token is tied to the web filter override feature, which must be enabled and in active use in the target deployment; second, user interaction is required, specifically the victim must click a crafted link delivered by the attacker. Exploitation is therefore limited to environments where the web filter override feature is configured and tokens have been provisioned. The CVSS AC:H rating reflects that obtaining a valid token is a non-trivial precondition beyond normal network access. Factors limiting exploitation include: the need for a legitimate or stolen override token (non-default privileged artifact), mandatory victim interaction (UI:R), and no direct confidentiality or availability impact even upon successful header injection.

The overall risk is low. The CVSS base score of 3.4 reflects the genuine constraints: AC:H captures the requirement for an attacker-held web filter override token (an out-of-band precondition), UI:R requires victim interaction, and the impact is limited to low integrity (I:L) with no confidentiality or availability impact. The S:C flag elevates the score slightly due to potential cross-component impact. No KEV listing confirms no mass exploitation. The temporal qualifiers E:P/RL:O/RC:C indicate an official Fortinet remediation exists and the vendor has confirmed the finding, but only partial exploit evidence is available - no weaponized exploit. EPSS data was not provided; absent that signal, the limited impact surface and high-complexity preconditions suggest this is a low-priority item for most environments. CVSS indicates network vector (AV:N) but meaningful exploitation also requires social engineering to achieve UI:R, making mass automated exploitation (automatable=No) unlikely.

An attacker who has obtained a valid FortiOS web filter override token - whether through credential theft, insider access, or social engineering - crafts a URL that embeds CRLF sequences in a parameter processed by the web filter override endpoint. The attacker then delivers this URL to a target user via phishing or a malicious webpage. When the user clicks the link, the FortiOS/FortiProxy system incorporates the unsanitized input into an HTTP response header, injecting attacker-controlled headers that could poison the user's browser cache or facilitate a follow-on cross-site scripting attack.