—–BEGIN PGP SIGNED MESSAGE—–

Hash: SHA256

Multiple vulnerabilities in Fortinet Products 

Indian – Computer Emergency Response Team (https://www.cert-in.org.in)

Severity Rating: HIGH

Systems Affected

FortiOS – versions affected include 6.0, 6.2, 6.4, 7.0, 7.2, 7.4 (through 7.4.8), 7.6 (through 7.6.3) in specific modules (e.g., CAPWAP).

FortiProxy – versions 7.0, 7.2, 7.4 and 7.6.0-7.6.3.

FortiWeb – versions 7.0 (all), 7.0.0-7.0.11, 7.2 (all), 7.2.0-7.2.11, 7.4 (all), 7.4.0-7.4.10, 8.0.0-8.0.1.

FortiMail – versions 7.0 (all), 7.2 (all), 7.4.0-7.4.5, 7.6.0-7.6.3.

FortiClient Windows – versions 7.0 (all), 7.2.0-7.2.10, 7.4.0-7.4.3.

FortiSASE – version 25.3.b.

FortiPAM – versions 1.0 through 1.6.0.

Overview

Multiple vulnerabilities have been reported in Fortinet Products which could allow an attacker to gain elevated privileges, execute arbitrary code or disclose sensitive information on the targeted system.

Target Audience:

All organizations and individuals using Fortinet products.

Risk Assessment:

High risk of system compromise, unauthorized command execution, privilege escalation, denial of service, and sensitive information disclosure.

Impact Assessment:

Execution of unauthorized code or commands, denial of service, disclosure of sensitive information, escalation of privilege, and improper access control.

Description

Fortinet is a global cybersecurity company that provides network security solutions, including firewalls, VPNs, and intrusion prevention systems.

These vulnerabilities exist in Fortinet products due to Heap-based Buffer Overflow vulnerability in Fortinet FortiClientWindows, Exposed IOCTL with Insufficient Access Control in Fortinet FortiClientWindows, Stack-based buffer overflow in Fortinet FortiOS, Active debug code vulnerability in Fortinet FortiClientWindows, Improper Privilege Management in Fortinet FortiOS and FortiPAM, Improper Neutralization of CRLF Sequences (crlf injection) in Fortinet FortiMail, Special Elements used in an OS Command (OS Command Injection) and Use of Hard-coded Credentials Vulnerability in Fortinet FortiWeb.

Successful exploitation of these vulnerabilities could allow an attacker to gain elevated privileges, execute arbitrary code or disclose sensitive information, on the targeted system.

OS command injection vulnerability (CVE-2025-58034) exists due to improper neutralization of special elements in user-supplied input. This vulnerability may allow an authenticated remote attacker to execute arbitrary commands by sending specially crafted HTTP requests or CLI inputs, on the targeted system.

Note: This vulnerability is being exploited in the wild.

Solution

Apply appropriate security updates as mentioned in:

https://fortiguard.fortinet.com/psirt/FG-IR-25-112

https://fortiguard.fortinet.com/psirt/FG-IR-25-125

https://fortiguard.fortinet.com/psirt/FG-IR-25-358

https://fortiguard.fortinet.com/psirt/FG-IR-25-513

https://fortiguard.fortinet.com/psirt/FG-IR-25-545

https://fortiguard.fortinet.com/psirt/FG-IR-25-632

https://fortiguard.fortinet.com/psirt/FG-IR-25-634

https://fortiguard.fortinet.com/psirt/FG-IR-25-843

https://fortiguard.fortinet.com/psirt/FG-IR-25-844

Vendor Information

Fortinet Products

https://fortiguard.fortinet.com/psirt/FG-IR-25-112

https://fortiguard.fortinet.com/psirt/FG-IR-25-125

https://fortiguard.fortinet.com/psirt/FG-IR-25-358

https://fortiguard.fortinet.com/psirt/FG-IR-25-513

https://fortiguard.fortinet.com/psirt/FG-IR-25-545

https://fortiguard.fortinet.com/psirt/FG-IR-25-632

https://fortiguard.fortinet.com/psirt/FG-IR-25-634

https://fortiguard.fortinet.com/psirt/FG-IR-25-843

https://fortiguard.fortinet.com/psirt/FG-IR-25-844

CVE Name

CVE-2025-46373

CVE-2025-47761

CVE-2025-53843

CVE-2025-54660

CVE-2025-54821

CVE-2025-54972

CVE-2025-58034

CVE-2025-58413

CVE-2025-59669

– —

Thanks and Regards,

CERT-In

Incident Response Help Desk

e-mail: incident@cert-in.org.in

Phone: +91-11-22902657

Toll Free Number: 1800-11-4949

Toll Free Fax : 1800-11-6969

Web: http://www.cert-in.org.in

PGP Fingerprint: A768 083E 4475 5725 B81A A379 2156 C0C0 B620 D0B4

PGP Key information:

https://www.cert-in.org.in/s2cMainServlet?pageid=CONTACTUS

Postal address:

Indian Computer Emergency Response Team (CERT-In)

Ministry of Electronics and Information Technology

Government of India

Electronics Niketan

6, C.G.O. Complex

New Delhi-110 003

—–BEGIN PGP SIGNATURE—–

iQIzBAEBCAAdFiEE6r4Iam/Ey0c/KakL3jCgcSdcys8FAmkeyQsACgkQ3jCgcSdc

ys96NA//XuWwqusYGCqO/7uBCp34DM2lliJOmt98YT6oGjPk8fmWZ1Rimz6QUEEN

ioKFLttISeEoyPrsijzepeqcdRlaY7ChW/6E4pwR8cK4XPa9Fnq5BaBKbeBUAM8k

rjph/9qaBnrik/VJZlv0T1SesW0pz/GSb8iY6ridVl9I6szdaY/KwRH0gFdkl/Sg

5ULm0PQkECN17/dKOT4Lc72Y0Rm7Gsi285nyJG9eVqR2SUOMCXip9IxojDvjf9EO

eqb1SDgo53rnnNTdRoYJL36KvXN81Ij5ZC37hX8++czy8edLhJGZv1+2s+p+kxhW

nMZrOE/55aMdJZJtleYa/dfpGc8cb0vXeJjKWro7DXk/5++aTmxPl/0Q6/xiQznr

L1nL/lISaP5Gor8OClJXfycfXxR2Opr8R74naSjnQjTUIpQOA35TgG1p7Nps9Lku

bk/mBxjhkElzGbLZyP5AgDBvkGCQSx8BEuUh0fZbUSgIj7BPSTObXAonzOl+WtAF

phJnz7Cd8JtPPODoGeCqx++o5p/i48IOE4RT73a+3afbj5CP4K11H7YQxzHL+hiV

PVPErI8xmm5rXkCnjNznKHocqjHzN9Ymahs1XGC9a13OYlauyCyiyNisbOUvzrmS

gPImhXjTnStI7G/+TnNRK0FyENsKr0iFXjDbuArZvtFOrPfpARU=

=iM54

—–END PGP SIGNATURE—–