PT-2025-32883 · Fortinet · Fortiweb
Avivnix
·
Publicado
2025-08-12
·
Atualizado
2026-01-12
·
CVE-2025-52970
CVSS v3.1
8.1
Alta
| Vetor | AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Fortinet FortiWeb versions 7.0 through 7.6
Fortinet FortiWeb versions 7.6.3 and below
Fortinet FortiWeb versions 7.4.7 and below
Fortinet FortiWeb versions 7.2.10 and below
Fortinet FortiWeb versions 7.0.10 and below
Description
An improper handling of parameters in Fortinet FortiWeb allows an unauthenticated remote attacker with non-public information pertaining to the device and targeted user to gain administrative privileges. The issue stems from an out-of-bounds read during cookie parsing, enabling attackers to forge authentication cookies and bypass authentication. Exploitation involves manipulating the 'Era' cookie parameter to force the server to use a predictable secret key for session encryption and HMAC signing. Successful exploitation allows an attacker to impersonate any user, including administrators, via the
/api/v2.0/system/status.systemstatus endpoint and potentially gain access to the command-line interface via /ws/cli/open. Active exploitation of this issue has been observed, with attackers originating from multiple IP addresses. There are reports of widespread attacks exploiting this vulnerability.Recommendations
Update to FortiWeb version 7.6.4 or later.
Update to FortiWeb version 7.4.8 or later.
Update to FortiWeb version 7.2.11 or later.
Update to FortiWeb version 7.0.11 or later.
Exploit
Correção
LPE
RCE
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Fortiweb