CVE-2025-47856: Fortinet FortiVoice RCE Vulnerability

CVE-2025-47856 Overview

CVE-2025-47856 affects Fortinet FortiVoice and consists of two OS command injection vulnerabilities [CWE-78]. The flaws allow a privileged attacker to execute arbitrary code or commands by sending crafted HTTP, HTTPS, or CLI requests. The vulnerabilities stem from improper neutralization of special elements used in operating system commands. Fortinet rates the issue as high severity, with full impact to confidentiality, integrity, and availability of the underlying system.

Critical Impact
A privileged attacker can achieve arbitrary command execution on FortiVoice systems, gaining control over enterprise voice communications infrastructure.

Affected Products

Fortinet FortiVoice 7.2.0
Fortinet FortiVoice 7.0.0 through 7.0.6
Fortinet FortiVoice versions before 6.4.10

Discovery Timeline

2025-10-14 - CVE-2025-47856 published to NVD
2025-10-16 - Last updated in NVD database

Technical Details for CVE-2025-47856

Vulnerability Analysis

The vulnerability resides in FortiVoice request handlers that pass user-supplied input into operating system command invocations. Two distinct code paths fail to neutralize shell metacharacters before constructing commands. An authenticated attacker with high privileges can inject shell operators into HTTP, HTTPS, or CLI request parameters. The injected payload executes within the context of the FortiVoice service account, providing direct access to the underlying operating system.

FortiVoice handles enterprise voice communications, call routing, and voicemail. Compromise of the system enables interception of voice traffic, exfiltration of stored recordings, and pivoting into adjacent network segments. The attack requires network access to the management interface or CLI.

Root Cause

The root cause is improper neutralization of special elements used in an OS command [CWE-78]. Input received through HTTP, HTTPS, and CLI request handlers is incorporated into shell command strings without sanitization or use of parameterized execution APIs. Shell metacharacters such as ;, |, &, $(), and backticks are interpreted by the underlying shell rather than treated as literal data.

Attack Vector

Exploitation requires authenticated administrative access to FortiVoice. The attacker submits a crafted HTTP/HTTPS request to the web management interface or issues a malicious CLI command containing shell metacharacters in a vulnerable parameter. The FortiVoice backend concatenates the attacker payload into a shell command and executes it, yielding arbitrary command execution with the privileges of the service process.

The vulnerability mechanism follows the standard CWE-78 pattern. See the Fortinet Security Advisory FG-IR-25-250 for vendor technical details.

Detection Methods for CVE-2025-47856

Indicators of Compromise

Unexpected child processes spawned by FortiVoice service binaries, particularly shells (/bin/sh, /bin/bash) or interpreters launched from web handler contexts.
HTTP/HTTPS request logs containing shell metacharacters such as ;, |, &&, $(), or backticks in administrative API parameters.
CLI session audit entries showing administrative accounts issuing commands with embedded shell operators in parameter values.
Outbound network connections initiated by FortiVoice processes to untrusted hosts following administrative requests.

Detection Strategies

Monitor administrator authentication events for anomalous source IPs, off-hours logins, or sessions preceding unusual process activity on FortiVoice appliances.
Inspect HTTP/HTTPS traffic to the FortiVoice management interface for shell metacharacters in POST bodies and query parameters using IDS/IPS signatures.
Correlate CLI command audit logs with subsequent process creation events to identify command injection patterns.

Monitoring Recommendations

Forward FortiVoice system logs, web access logs, and CLI audit logs to a centralized SIEM for analysis and long-term retention.
Establish a baseline of normal process trees for FortiVoice services and alert on deviations.
Restrict and monitor administrative access to the FortiVoice management plane through network segmentation and jump hosts.

How to Mitigate CVE-2025-47856

Immediate Actions Required

Upgrade FortiVoice to a fixed version as specified in Fortinet PSIRT advisory FG-IR-25-250.
Restrict administrative access to the FortiVoice management interface and CLI to trusted management networks only.
Audit administrative accounts and rotate credentials for any account that may have been exposed.
Review CLI and web access logs for evidence of exploitation attempts predating the patch.

Patch Information

Fortinet has released fixed versions addressing CVE-2025-47856. Administrators should consult Fortinet Security Advisory FG-IR-25-250 for the specific patched releases and upgrade paths corresponding to the deployed FortiVoice branch.

Workarounds

Limit FortiVoice administrative access to a small set of trusted IP addresses via firewall rules or trusted host configuration.
Enforce multi-factor authentication for all administrative accounts to reduce risk of credential compromise.
Disable unused management protocols and interfaces on FortiVoice appliances until the patch can be applied.

bash

# Example: restrict FortiVoice management access to a trusted subnet
config system interface
    edit port1
        set allowaccess https ssh
        set trusthost1 10.10.0.0 255.255.255.0
    next
end