CVEvulnerability
CVE-2025-52970
8.1 HIGH
Official page ↗
- Status
- Analyzed
- Published
- 2025-08-12
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 8.1 HIGH — CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weaknesses
- CWE-233
Description
A improper handling of parameters in Fortinet FortiWeb versions 7.6.3 and below, versions 7.4.7 and below, versions 7.2.10 and below, and 7.0.10 and below may allow an unauthenticated remote attacker with non-public information pertaining to the device and targeted user to gain admin privileges on the device via a specially crafted request.
Affected configurations
• fortinet fortiweb (>= 7.0.0 < 7.0.11)
• fortinet fortiweb (>= 7.2.0 < 7.2.11)
• fortinet fortiweb (>= 7.4.0 < 7.4.8)
• fortinet fortiweb (>= 7.6.0 < 7.6.4)
Related
Weakness · CWE (1)
- CWE-233 Improper Handling of Parameters weakness
References
- https://fortiguard.fortinet.com/psirt/FG-IR-25-448 Vendor Advisory
- https://pwner.gg/blog/2025-08-13-fortiweb-cve-2025-52970 Exploit, Third Party Advisory