Product:
FortiSIEM
Summary
An improper neutralization of special elements used in an os command vulnerability in Fortinet FortiSIEM may allow an attacker to execute unauthorized code or commands via crafted TCP requests. This affects multiple versions of FortiSIEM, making it critical for users to address the vulnerability promptly. The potential for high impact on confidentiality, integrity, and availability underscores the severity of this issue.
Details
| Severity | Base Score | CVE |
|---|---|---|
| CRITICAL | 9.8 | CVE-2025-64155 |
Exploitation
To exploit this vulnerability, an attacker can send specially crafted TCP requests to the affected FortiSIEM products. By manipulating the input to the system, the attacker can trigger the os command injection, allowing them to execute arbitrary commands on the server. This requires no special privileges and can be done remotely, making it a significant threat to the security of the affected systems.
Affected Products
- FortiSIEM 7.4.0
- FortiSIEM 7.3.0 through 7.3.4
- FortiSIEM 7.1.0 through 7.1.8
- FortiSIEM 7.0.0 through 7.0.4
- FortiSIEM 6.7.0 through 6.7.10
Mitigation
To mitigate this vulnerability, users should update their FortiSIEM installations to the latest versions that have addressed the os command injection issue. Regularly applying security patches and monitoring for unusual activity can also help reduce the risk of exploitation. It is crucial for organizations to maintain a robust security posture to protect against such vulnerabilities.