CVE-2025-66178

EUVD-2025-208496
A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.1, FortiWeb 7.6.0 through 7.6.5, FortiWeb 7.4.0 through 7.4.11, FortiWeb 7.2.0 through 7.2.12, FortiWeb 7.0.0 through 7.0.12 may allow an authenticated attacked to execute arbitrary commands via a specialy crafted HTTP request.
OS Command Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.2 HIGH
NETWORK
LOW
HIGH
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
fortinetCNA
6.7 MEDIUM
NETWORK
LOW
HIGH
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Affected Products (NVD)
VendorProductVersion
fortinetfortiweb
7.0.0 ≤
𝑥
< 7.0.13
fortinetfortiweb
7.2.0 ≤
𝑥
< 7.2.13
fortinetfortiweb
7.4.0 ≤
𝑥
< 7.4.12
fortinetfortiweb
7.6.0 ≤
𝑥
< 7.6.7
fortinetfortiweb
8.0.0 ≤
𝑥
< 8.0.3
𝑥
= Vulnerable software versions
Common Weakness Enumeration
Vulnerability Media Exposure
References
https://fortiguard.fortinet.com/psirt/FG-IR-26-088