CVEvulnerability
CVE-2025-64155
9.8 CRITICAL
Official page ↗
- Status
- Modified
- Published
- 2026-01-13
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weaknesses
- CWE-78
Description
An improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSIEM 7.4.0, FortiSIEM 7.3.0 through 7.3.4, FortiSIEM 7.1.0 through 7.1.8, FortiSIEM 7.0.0 through 7.0.4, FortiSIEM 6.7.0 through 6.7.10 may allow an attacker to execute unauthorized code or commands via crafted TCP requests.
Affected configurations
• fortinet fortisiem (>= 6.7.0 < 7.1.9)
• fortinet fortisiem (>= 7.2.0 < 7.2.7)
• fortinet fortisiem (>= 7.3.0 < 7.3.5)
• fortinet fortisiem 7.4.0
Related
Weakness · CWE (1)
- CWE-78 Improper Neutralization of Special Elements used in an OS Command weakness
References
- https://fortiguard.fortinet.com/psirt/FG-IR-25-772 Vendor Advisory
- https://github.com/horizon3ai/CVE-2025-64155 Exploit, Third Party Advisory
- https://github.com/purehate/CVE-2025-64155-hunter github.com