CVE-2025-25256: Fortinet FortiSIEM RCE Vulnerability

CVE-2025-25256 Overview

CVE-2025-25256 is a pre-authentication OS command injection vulnerability [CWE-78] in Fortinet FortiSIEM. The flaw allows an unauthenticated remote attacker to execute arbitrary commands on affected appliances through crafted command-line interface (CLI) requests. Fortinet disclosed the issue in FortiGuard PSIRT Advisory FG-IR-25-152, and security researchers at watchTowr published a public proof-of-concept shortly after disclosure. Affected versions span FortiSIEM 7.3.0 through 7.3.1, 7.2.0 through 7.2.5, 7.1.0 through 7.1.7, 7.0.0 through 7.0.3, and all releases before 6.7.9.

Critical Impact

An unauthenticated attacker can execute arbitrary OS commands on FortiSIEM appliances, leading to full compromise of a centralized security monitoring platform.

Affected Products

• Fortinet FortiSIEM 7.3.0 through 7.3.1
• Fortinet FortiSIEM 7.2.0 through 7.2.5, 7.1.0 through 7.1.7, and 7.0.0 through 7.0.3
• Fortinet FortiSIEM versions before 6.7.9

Discovery Timeline

• 2025-08-12 - CVE-2025-25256 published to NVD and disclosed by Fortinet in advisory FG-IR-25-152
• 2025-08-13 - Public reporting of the vulnerability and release of a watchTowr proof-of-concept
• 2025-08-15 - Last updated in NVD database

Technical Details for CVE-2025-25256

Vulnerability Analysis

The vulnerability is an improper neutralization of special elements used in an OS command, classified as [CWE-78]. FortiSIEM exposes a CLI request handler that accepts input from the network and incorporates it into a system command without adequate sanitization. An unauthenticated attacker can inject shell metacharacters into the crafted request, causing the appliance to execute attacker-controlled commands in the context of the FortiSIEM service account.

FortiSIEM is a security information and event management platform that aggregates logs, alerts, and telemetry across an enterprise. Compromise of the appliance gives an attacker access to collected security data, stored credentials for log sources, and a trusted foothold inside the monitoring infrastructure. The high EPSS percentile reflects elevated near-term exploitation likelihood.

Root Cause

The root cause is unsafe construction of an OS-level command from untrusted input received by the CLI request interface. The handler passes attacker-supplied data to a shell or command execution function without escaping, quoting, or strict allow-listing. Because no authentication is required to reach the vulnerable endpoint, any network attacker who can connect to the FortiSIEM service can trigger the injection.

Attack Vector

Exploitation occurs over the network against an exposed FortiSIEM management interface. The attacker sends a crafted CLI request containing shell metacharacters or chained commands. The vulnerable handler concatenates this input into a command line and executes it, returning control of the underlying operating system to the attacker. Technical details are available in the watchTowr Labs analysis.

No verified code example is reproduced here. Refer to the watchTowr PoC repository for technical artifacts.

Detection Methods for CVE-2025-25256

Indicators of Compromise

• Unexpected child processes spawned by the FortiSIEM service account, such as /bin/sh, bash, curl, wget, or nc.
• Outbound connections from the FortiSIEM appliance to unknown external hosts following inbound CLI traffic.
• New or modified files in FortiSIEM web roots, cron directories, or user home directories without an associated administrator change record.
• Anomalous CLI requests containing shell metacharacters such as ;, |, `, $(), or newline encodings.

Detection Strategies

• Inspect FortiSIEM service and access logs for malformed or oversized CLI requests, and for requests originating from non-administrative source addresses.
• Hunt for process lineage where the FortiSIEM application process is the parent of a shell or networking utility.
• Correlate inbound network traffic to the FortiSIEM management port with subsequent outbound connections from the appliance.

Monitoring Recommendations

• Forward FortiSIEM operating system logs, audit logs, and process telemetry to an independent log store so the appliance cannot tamper with its own evidence.
• Alert on changes to FortiSIEM binaries, scripts, and configuration files outside scheduled upgrade windows.
• Monitor for new SSH keys, scheduled tasks, or local accounts on the FortiSIEM host.

How to Mitigate CVE-2025-25256

Immediate Actions Required

• Upgrade FortiSIEM to a fixed release per the FortiGuard PSIRT advisory FG-IR-25-152.
• Restrict network access to the FortiSIEM management and CLI service so only trusted administrative networks can reach the appliance.
• Review FortiSIEM hosts for signs of compromise dating back to the earliest possible exposure window, and rotate any credentials, API keys, or certificates stored on the appliance.

Patch Information

Fortinet has published fixed builds for each supported branch in advisory FG-IR-25-152. Administrators running FortiSIEM 7.3, 7.2, 7.1, 7.0, or 6.7 must apply the corresponding patched release. Versions before 6.7.9 should be upgraded to 6.7.9 or later. Confirm patch level after upgrade and validate that the CLI service is restarted.

Workarounds

• Block external access to the FortiSIEM CLI service port at the perimeter and at internal firewalls until patching is complete.
• Place the FortiSIEM appliance behind a jump host or VPN that enforces authentication before any network traffic reaches the vulnerable service.
• Enable strict source-IP allow-listing for administrative access where the platform supports it.

# Example: restrict inbound access to FortiSIEM management interface
# using an upstream Linux firewall (replace 10.0.0.0/24 with your admin range)
iptables -A INPUT -p tcp -s 10.0.0.0/24 --dport 443 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP