ByteOS Network

NVD Vulnerability Details :

CVE-2025-52970

Analyzed

Source-psirt@fortinet.com

Published At-12 Aug, 2025 | 19:15

Updated At-15 Aug, 2025 | 12:26

A improper handling of parameters in Fortinet FortiWeb versions 7.6.3 and below, versions 7.4.7 and below, versions 7.2.10 and below, and 7.0.10 and below may allow an unauthenticated remote attacker with non-public information pertaining to the device and targeted user to gain admin privileges on the device via a specially crafted request.

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Secondary	3.1	8.1	HIGH	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

CPE Matches

Fortinet, Inc.

>>fortiweb>>Versions from 7.0.0(inclusive) to 7.0.11(exclusive)

cpe:2.3:a:fortinet:fortiweb:*:*:*:*:*:*:*:*

Fortinet, Inc.

>>fortiweb>>Versions from 7.2.0(inclusive) to 7.2.11(exclusive)

cpe:2.3:a:fortinet:fortiweb:*:*:*:*:*:*:*:*

Fortinet, Inc.

>>fortiweb>>Versions from 7.4.0(inclusive) to 7.4.8(exclusive)

cpe:2.3:a:fortinet:fortiweb:*:*:*:*:*:*:*:*

Fortinet, Inc.

>>fortiweb>>Versions from 7.6.0(inclusive) to 7.6.4(exclusive)

cpe:2.3:a:fortinet:fortiweb:*:*:*:*:*:*:*:*

Weaknesses

CWE ID	Type	Source
CWE-233	Secondary	psirt@fortinet.com

References

Hyperlink	Source	Resource
https://fortiguard.fortinet.com/psirt/FG-IR-25-448	psirt@fortinet.com	Vendor Advisory
https://pwner.gg/blog/2025-08-13-fortiweb-cve-2025-52970	134c704f-9b21-4f2e-91b3-4a467353bcc0	Exploit Third Party Advisory

CISA Catalog

Metrics

CPE Matches

Weaknesses

Evaluator Description

Evaluator Impact

Evaluator Solution

Vendor Statements

References

Change History