CrowdSecLive Exploit Tracker
Background NoiseCVE-2025-25257Public Exploit

Fortinet FortiWeb Fabric Connector - SQLi (CVE-2025-25257)

PublishedJul 11, 2025
First SeenJul 11, 2025
Last Seen
Reported
CVSS9.6
Fortinet
FortinetFortinet
enterprise_softwarefirewall

Description

Fortinet FortiWeb Fabric Connector is impacted by a pre-authentication SQL injection vulnerability. A remote unauthenticated attacker can exploit this vulnerability to execute arbitrary SQL commands via a specially crafted HTTP request, leading to unauthorized access that can be used to achieve Remote Code Executuion.

psychologyCrowdSec Analysis

CVE-2025-25257 is a pre-authentication SQL injection vulnerability in Fortinet FortiWeb Fabric Connector. A remote unauthenticated attacker can exploit this vulnerability to execute arbitrary SQL commands and achieve Remote Code Execution.

CrowdSec has been tracking this vulnerability and its exploits since 30th of June 2025.

CrowdSec network data shows that most actors exploiting CVE-2025-25257 rely on broad, untargeted scans with minimal filtering. The activity is largely automated and opportunistic in nature. Data from the CrowdSec community also indicates a gradual decrease in attacks targeting CVE-2025-25257. While still present in the wild, exploitation levels have dropped noticeably week-over-week. This may signal that the vulnerability is becoming less relevant or that defenses are improving fast enough for attackers to lose interest.

Attackers exploit this vulnerability by sending specially crafted HTTP requests to the Fortinet FortiWeb Fabric Connector. This can allow them to execute arbitrary SQL commands on the database via the /api/fabric/device/status URI.

lock

Full Intelligence Available

Connect your API key to access CrowdSec scores, exploit timelines, and attacker IPs.

EventDate
Rule Released2025-06-30
CVE Published2025-07-11
CrowdSec First Seen2025-07-11
CISA KEV2025-07-18
CISA Remediation Deadline2025-08-08

Related Weaknesses

CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

arrow_forward

Remediation & Protection

lock to download blocklists, subscribe to firewalls, and access IP intelligence.

External References