CVE-2025-25256 - Fortinet FortiSIEM Vulnerability (CVE-2025-25256)

August 15, 2025

Summary

Fortinet FortiSIEM (versions 6.7.9 and earlier) contains a critical OS Command Injection vulnerability (CVE-2025-25256), which could allow attackers to execute arbitrary commands. This flaw has been assigned a CVSS score of 9.8 and poses a serious security risk. Fortinet recommends immediate upgrades to secure the affected systems.

Highlights

• 🚨 Critical Security Flaw: FortiSIEM versions 6.7.9 and earlier are vulnerable to an OS Command Injection attack, with a CVSS score of 9.8.

• 💻 Remote Code Execution: The flaw allows unauthenticated attackers to execute arbitrary code on the underlying operating system.

• 🛑 Impact on Enterprise Security: FortiSIEM provides real-time analytics and event correlation, and a successful exploit could lead to complete system compromise.

• 🕵️‍♂️ Vulnerable Service: The issue resides in the phMonitor service (TCP port 7900), responsible for monitoring FortiSIEM processes.

• 🔐 Exploit Risk: Attackers could use crafted CLI requests to bypass input sanitization, gaining unauthorized access to the system.

• 🛠️ Fix Available: Fortinet recommends upgrading to patched versions: 7.3.2+, 7.2.6+, 7.1.8+, 7.0.4+, and 6.7.10+.

• ⚠️ Temporary Workaround: If unable to patch immediately, limiting access to TCP port 7900 is suggested to reduce risk until an update can be applied.

Source : NVD