Product:
FortiOS
Summary
A use of externally-controlled format string vulnerability in Fortinet FortiOS versions 7.6.0 through 7.6.4, 7.4.0 through 7.4.9, 7.2.0 through 7.2.11, and all versions of 7.0 allows an authenticated admin to execute unauthorized code or commands via specifically crafted configuration.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 6.7 | CVE-2025-64157 |
Exploitation
To exploit this vulnerability, an attacker with authenticated admin access can craft a specific configuration that manipulates the format string. This crafted input can lead to the execution of unauthorized code or commands, potentially compromising the system’s integrity and confidentiality.
Affected Products
- FortiOS 7.6.0 through 7.6.4
- FortiOS 7.4.0 through 7.4.9
- FortiOS 7.2.0 through 7.2.11
- FortiOS 7.0 all versions
Mitigation
To mitigate this vulnerability, it is recommended that users upgrade to the latest version of FortiOS that addresses this issue. Additionally, restricting admin access and monitoring configuration changes can help reduce the risk of exploitation.