CVE-2025-58325: Fortinet FortiOS RCE Vulnerability

CVE-2025-58325 Overview

CVE-2025-58325 is an Incorrect Provision of Specified Functionality vulnerability [CWE-684] affecting multiple versions of Fortinet FortiOS. The flaw allows a local authenticated attacker with high privileges to execute system commands through crafted command-line interface (CLI) inputs. Fortinet disclosed the issue in advisory FG-IR-24-361 and assigned a CVSS v3.1 base score of 6.7. Exploitation requires local access and elevated privileges, which limits opportunistic abuse but retains risk in scenarios involving compromised administrator accounts or insider threats.

Critical Impact
An authenticated administrator can escape intended CLI boundaries and execute arbitrary system commands on the underlying FortiOS platform, impacting confidentiality, integrity, and availability of the appliance.

Affected Products

Fortinet FortiOS 7.6.0
Fortinet FortiOS 7.4.0 through 7.4.5, 7.2.5 through 7.2.10, 7.0.0 through 7.0.15
Fortinet FortiOS 6.4 (all versions)

Discovery Timeline

2025-10-14 - CVE-2025-58325 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-58325

Vulnerability Analysis

The vulnerability stems from FortiOS improperly enforcing the intended boundaries of its administrative CLI. FortiOS exposes a restricted command interpreter that is expected to constrain administrators to a defined set of operations against the appliance. The CWE-684 classification indicates that the CLI provides functionality in a manner inconsistent with its specification.

A local authenticated attacker with high privileges can submit crafted CLI commands that break out of these constraints. The result is execution of system commands on the underlying operating system, bypassing the restricted shell abstraction that separates administrative configuration from operating system access.

Because FortiOS is a network security appliance, unauthorized command execution can affect firewall policy enforcement, VPN termination, logging, and inspection capabilities. See the Fortinet PSIRT Advisory FG-IR-24-361 for vendor-supplied technical context.

Root Cause

The root cause lies in incorrect provisioning of specified functionality within the CLI parser or command dispatcher. FortiOS accepts CLI input that, when structured in a specific way, invokes system-level operations that were never intended to be reachable through the administrative interface.

Attack Vector

Exploitation requires local access to the FortiOS CLI and an account with high privileges, typically an administrator or a role holding equivalent command-execution rights. The attack does not require user interaction. An adversary who has compromised administrator credentials, or a malicious insider with legitimate access, can invoke the crafted CLI sequence to obtain command execution on the appliance.

No public proof-of-concept has been released, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2025-58325

Indicators of Compromise

Unexpected CLI sessions from administrator accounts originating from unusual source IP addresses or at atypical times.
CLI command history containing malformed, unusually long, or non-standard command sequences that deviate from documented FortiOS syntax.
Configuration changes, new administrative accounts, or modified logging settings that were not authorized through change management.

Detection Strategies

Enable and forward FortiOS event logs, admin logs, and CLI audit logs to a centralized SIEM for correlation and retention.
Baseline normal administrator command patterns and alert on CLI activity that deviates from that baseline, particularly commands invoking diagnostic or debug functions.
Correlate administrator authentication events with subsequent CLI activity to identify sessions that immediately execute anomalous command sequences.

Monitoring Recommendations

Monitor for privilege changes, new admin accounts, and modifications to trusted host lists on FortiOS devices.
Track outbound connections from FortiOS management interfaces that could indicate reverse shells or unauthorized data movement following CLI abuse.
Review FortiManager and FortiAnalyzer records for configuration drift between authorized baselines and current appliance state.

How to Mitigate CVE-2025-58325

Immediate Actions Required

Inventory all FortiOS devices and identify instances running 7.6.0, 7.4.0 through 7.4.5, 7.2.5 through 7.2.10, 7.0.0 through 7.0.15, or any 6.4 release.
Apply the fixed FortiOS releases listed in Fortinet PSIRT Advisory FG-IR-24-361 as soon as a change window permits.
Rotate administrator credentials and API tokens on affected appliances, and audit recent administrative activity for signs of misuse.

Patch Information

Fortinet has published fixed versions and upgrade guidance in advisory FG-IR-24-361. Administrators should consult the vendor advisory for the specific patched build corresponding to their current FortiOS train and follow Fortinet's documented upgrade path.

Workarounds

Restrict CLI and management access to a dedicated management network using trusthost entries and dedicated management interfaces.
Enforce multi-factor authentication for all administrator accounts to reduce the risk of credential compromise leading to local exploitation.
Apply least-privilege role-based access control so that only a minimal set of accounts hold the high privileges required to reach the vulnerable CLI paths.

bash

# Configuration example - restrict admin access to a management subnet
config system admin
    edit "admin"
        set trusthost1 10.10.10.0 255.255.255.0
        set accprofile "super_admin"
    next
end

config system global
    set admin-lockout-threshold 3
    set admin-lockout-duration 300
end