FortiSIEM - RCE (CVE-2025-25256)
Description
An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability [CWE-78] in Fortinet FortiSIEM version 7.3.0 through 7.3.1, 7.2.0 through 7.2.5, 7.1.0 through 7.1.7, 7.0.0 through 7.0.3 and before 6.7.9 allows an unauthenticated attacker to execute unauthorized code or commands via crafted CLI requests.
psychologyCrowdSec Analysis
CVE-2025-25256 is a critical OS command injection vulnerability in multiple versions of Fortinet FortiSIEM, allowing unauthenticated attackers to execute arbitrary code or commands through specially crafted CLI requests. This flaw could be exploited remotely to gain full control over affected systems, leading to data breaches, system compromise, or disruption of security monitoring operations.
CrowdSec has been tracking this vulnerability and its exploits since 3rd of September 2025.
CrowdSec has not observed any significant exploitation activity targeting CVE-2025-25256 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.
Attackers exploit FortiSIEM instances by sending specially crafted TCP payloads to port 7900, embedding OS commands within XML fields such as <archive_nfs_archive_dir>, enabling remote command execution without authentication.
Full Intelligence Available
Connect your API key to access CrowdSec scores, exploit timelines, and attacker IPs.
| Event | Date |
|---|---|
| CVE Published | 2025-08-12 |
| Rule Released | 2025-09-03 |
Remediation & Protection
External References
- https://github.com/watchtowrlabs/watchTowr-vs-FortiSIEM-CVE-2025-25256
- https://fortiguard.fortinet.com/psirt/FG-IR-25-152
- https://labs.watchtowr.com/should-security-solutions-be-secure-maybe-were-all-wrong-fortinet-fortisiem-pre-auth-command-injection-cve-2025-25256/
- https://github.com/projectdiscovery/nuclei-templates/blob/main/network/cves/2025/CVE-2025-25256.yaml