CVE-2025-58903: Fortinet FortiOS DOS Vulnerability

CVE-2025-58903 Overview

CVE-2025-58903 is an Unchecked Return Value vulnerability [CWE-252] affecting Fortinet FortiOS versions 7.6.0 through 7.6.3 and versions prior to 7.4.8. The flaw resides in the FortiOS API and allows an authenticated attacker to trigger a Null Pointer Dereference by submitting a specially crafted request. Successful exploitation crashes the HTTP daemon, disrupting management access to the affected appliance. The issue impacts availability only and does not lead to code execution or data disclosure. Fortinet published details in advisory FG-IR-25-653, and Siemens issued a related notice SSA-864900 for downstream products.

Critical Impact
An authenticated attacker with high privileges can repeatedly crash the FortiOS HTTP daemon, disrupting the management plane and any HTTP-based administrative services on the appliance.

Affected Products

Fortinet FortiOS 7.6.0 through 7.6.3
Fortinet FortiOS versions prior to 7.4.8
Siemens products bundling affected FortiOS releases (see SSA-864900)

Discovery Timeline

2025-10-14 - CVE-2025-58903 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-58903

Vulnerability Analysis

The vulnerability stems from an unchecked return value inside a FortiOS API code path served by the HTTP daemon. When a function returns a null pointer under specific input conditions, the caller dereferences it without validation. This dereference crashes the HTTP daemon process, terminating management sessions and blocking further HTTP-based administration. Because the flaw affects availability of the management interface rather than confidentiality or integrity, the practical impact is denial of service against the appliance's HTTP services. Repeated exploitation can keep the daemon in a crash loop and prevent administrators from restoring the device through the web UI or API.

Root Cause

The root cause is a missing return-value check [CWE-252] in a FortiOS API handler. The affected function returns a null pointer on certain error paths, but downstream code assumes a valid object and dereferences it. This condition triggers the crash of the HTTP daemon.

Attack Vector

Exploitation requires network access to the FortiOS management API and valid credentials with high privileges. The attacker sends a specially crafted API request to reach the vulnerable code path. No user interaction is required, and the attack complexity is low once authenticated access is available. Fortinet has not reported active exploitation, and no public proof of concept is available at this time.

No verified proof-of-concept code has been published. Refer to Fortinet advisory FG-IR-25-653 for vendor-supplied technical details.

Detection Methods for CVE-2025-58903

Indicators of Compromise

Unexpected termination or restart of the FortiOS httpd process recorded in system event logs.
Loss of availability for the web administration UI or REST API without a scheduled configuration change.
Repeated authenticated API requests from a single source followed by HTTP daemon crash events.

Detection Strategies

Alert on FortiOS crash log entries referencing the HTTP daemon, particularly recurring crashes within short windows.
Correlate administrative API authentication events with subsequent daemon failure events to identify abusive sessions.
Monitor FortiGate SNMP and syslog feeds for httpsd or httpd process restart counters incrementing abnormally.

Monitoring Recommendations

Forward FortiOS event and crash logs to a centralized SIEM for long-term retention and correlation.
Track administrative account activity against management interfaces and flag privileged sessions from unexpected source addresses.
Establish a baseline for HTTP daemon uptime and alert on deviations that suggest crash-loop behavior.

How to Mitigate CVE-2025-58903

Immediate Actions Required

Upgrade FortiOS to a fixed release as specified in Fortinet advisory FG-IR-25-653.
Restrict management interface exposure to trusted administrative networks and remove any internet-facing HTTP/HTTPS management access.
Rotate credentials for privileged administrative accounts and audit accounts with API access.

Patch Information

Fortinet addresses this vulnerability in FortiOS 7.4.8 and later, and in FortiOS releases beyond 7.6.3. Consult FG-IR-25-653 for the current list of fixed builds and upgrade guidance. Organizations running Siemens products that embed FortiOS should also review SSA-864900 for vendor-specific update instructions.

Workarounds

Disable HTTP/HTTPS administrative access on interfaces where it is not required and rely on SSH or console access for management.
Apply trusthost restrictions to administrator accounts so API requests are only accepted from designated management subnets.
Enforce multi-factor authentication for privileged administrators to reduce the risk of credential compromise leading to exploitation.

bash

# Example: restrict admin access to a management subnet on FortiOS
config system admin
    edit "admin"
        set trusthost1 10.10.0.0 255.255.255.0
        set accprofile "super_admin"
    next
end

# Example: disable HTTP/HTTPS admin access on an untrusted interface
config system interface
    edit "wan1"
        unset allowaccess
        set allowaccess ping
    next
end