Paper/Archive/CVE-2025-64155

CVE-2025-64155

Fortinet FortiSIEM — An improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSIEM 7.4.0,…

EPSS 44%public exploit CVSS 9.4

critical.is priorityof 100

CVSS 9.4 (CNA)9.4 / 10 × 3028.2 Not in CISA KEV+300.0 EPSS percentile 98.7.987 × 2019.7 Exploit: SSVC poc+1010.0 SSVC exploitation: poc+100.0

Description · from the CVE record

An improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSIEM 7.4.0, FortiSIEM 7.3.0 through 7.3.4, FortiSIEM 7.1.0 through 7.1.8, FortiSIEM 7.0.0 through 7.0.4, FortiSIEM 6.7.0 through 6.7.10 may allow an attacker to execute unauthorized code or commands via crafted TCP requests.

Affected

ProductAffectedFixed inSource

FortiSIEM7.4.0–CNA

FortiSIEM7.3.0 – 7.3.4–CNA

FortiSIEM7.2.6–CNA

FortiSIEM7.1.8–CNA

FortiSIEM7.0.4–CNA

FortiSIEM6.7.10–CNA

Scores by source

fortinet (CNA)9.4CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H/RL:O/RC:C

CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

reffortiguard.fortinet.com/psirt/FG-IR-25-772 exploitgithub.com/horizon3ai/CVE-2025-64155 exploitgithub.com/purehate/CVE-2025-64155-hunter