← Back

CVE-2025-67862

nvd nist
Published: Jun 9, 2026Modified: Jul 14, 2026

JSON object

Loading...
6.7
Vector
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Exploitability: 0.8 / Impact: 5.9
Source: psirt@fortinet.com (Secondary)

Description

An Internal Asset Exposed to Unsafe Debug Access Level or State vulnerability [CWE-1244] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.2, FortiOS 7.4.0 through 7.4.7, FortiOS 7.2.0 through 7.2.10, FortiOS 7.0.0 through 7.0.16, FortiOS 6.4 all versions, FortiProxy 7.6.0 through 7.6.3, FortiProxy 7.4.0 through 7.4.10, FortiProxy 7.2.0 through 7.2.14, FortiProxy 7.0 all versions may allow an authenticated admin to execute lua scripts via crafted CLI commands.

Affected (9)

Fortinet
2 products
Fortios
Fortiproxy
Configuration A
5 vulnerable
Vulnerable SoftwareAffected Versions
Fortinet
Fortios
From 6.4.0 to 6.4.16
Fortios
From 7.0.0 to 7.0.16
Fortios
From 7.2.0 to 7.2.11
Fortios
From 7.4.0 to 7.4.8
Fortios
From 7.6.0 to 7.6.3
Configuration B
4 vulnerable
Vulnerable SoftwareAffected Versions
Fortinet
Fortiproxy
From 7.0.0 to 7.0.23
Fortiproxy
From 7.2.0 to 7.2.15
Fortiproxy
From 7.4.0 to 7.4.11
Fortiproxy
From 7.6.0 to 7.6.4

Related CWEs

CWE-1244
Internal Asset Exposed to Unsafe Debug Access Level or State
The product uses physical debug or test interfaces with support for multiple access levels, but it assigns the wrong debug access level to an internal asset, providing unintended access to the asset from untrusted debug agents.

References (2)

Source: psirt@fortinet.com
Vendor Advisory
Source: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e

Timeline

No history available yet.