PT-2026-2488 · Fortinet · Fortisandbox

CVE-2025-67685 · Publicado 2026-01-13 · Atualizado 2026-02-04

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Média

Vetor base

AV:N/AC:L/Au:S/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Fortinet FortiSandbox versions 4.0 through 5.0.4 Fortinet FortiSandbox version 4.4 Fortinet FortiSandbox version 4.2

Description An authenticated attacker may be able to proxy internal requests limited to plaintext endpoints only by sending specially crafted HTTP requests. This is a Server-Side Request Forgery (SSRF) issue.

Recommendations Fortinet FortiSandbox versions prior to 5.0.5 should be updated. Fortinet FortiSandbox version 4.4 should be updated. Fortinet FortiSandbox version 4.2 should be updated.

Correção

RCE

SSRF

Enumeração de Fraquezas

CWE-918

Identificadores relacionados

BDU:2026-00508

CVE-2025-67685

ZDI-26-048

Produtos afetados

Fortisandbox

Referências · 8

• https://fortiguard.fortinet.com/psirt/FG-IR-25-783 · Aviso do Fabricante
• https://fortiguard.com/psirt/FG-IR-25-783 · Nota
• https://bdu.fstec.ru/vul/2026-00508 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2025-67685 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2025-67685 · Aviso do Fabricante
• https://zerodayinitiative.com/advisories/ZDI-26-048 · Nota de Segurança
• https://twitter.com/CVEnew/status/2011120640753873392 · Publicação no Twitter
• https://twitter.com/TheZDIBugs/status/2019122006491386310 · Publicação no Twitter