← Back

CVE-2025-52970

nvd nistnuclei
Published: Aug 12, 2025Modified: Jun 17, 2026

JSON object

Loading...
8.1
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Exploitability: 2.2 / Impact: 5.9
Source: psirt@fortinet.com (Secondary)

Description

A improper handling of parameters in Fortinet FortiWeb versions 7.6.3 and below, versions 7.4.7 and below, versions 7.2.10 and below, and 7.0.10 and below may allow an unauthenticated remote attacker with non-public information pertaining to the device and targeted user to gain admin privileges on the device via a specially crafted request.

Affected (4)

Products: Fortinet: Fortiweb
Fortinet
1 product
Fortiweb
Configuration A
4 vulnerable
Vulnerable SoftwareAffected Versions
Fortinet
Fortiweb
From 7.0.0 to 7.0.11
Fortiweb
From 7.2.0 to 7.2.11
Fortiweb
From 7.4.0 to 7.4.8
Fortiweb
From 7.6.0 to 7.6.4

Related CWEs

CWE-233
Improper Handling of Parameters
The product does not properly handle when the expected number of parameters, fields, or arguments is not provided in input, or if those parameters are undefined.

References (2)

Source: psirt@fortinet.com
Vendor Advisory
Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0
ExploitThird Party Advisory

Timeline

No history available yet.