Patch immediately: CVE-2025-25257 PoC enables remote code execution on Fortinet FortiWeb

PoC exploits released for critical Fortinet FortiWeb flaw allowing pre-auth RCE. Fortinet urges users to patch.

Exploits for pre-auth Fortinet FortiWeb RCE flaw released, patch now

Proof-of-concept exploits have been released for a critical SQLi vulnerability in Fortinet FortiWeb that can be used to achieve pre-authenticated remote code execution on vulnerable servers.

FortiWeb Pre-Auth RCE (CVE-2025-25257)

Hey! and welcome to another THEY BURNED MY BUG episode. This time, we introduce CVE-2025-25257. An SQLi that I spotted back in Feb. in case someone burn them before i get my bragging rights8157d42995395ba0c0cfccce37b934ebb63d3d5740ba43eda7fa853f389bca2a8fc4ca6426ae50c7673326eacb6644a8b361ad1051138d04cbd9da8b807a0973— faulty *ptrrr (@0x_shaq) February 9, 2025 This is a pre-auth SQLi bug that can be leveraged to an RCE in FortiWeb.

Warn- und Informationsdienst

Warn- und Informationsdienst

Warn- und Informationsdienst

Empowering the API Fortress Using FortiWeb Cloud WAF as a Service with Fortinet - Gestalt IT

In this Cloud Field Day article presented by Fortinet, Chris Hildebrandt discusses the FortiWeb Cloud WAF-as-a-Service to empower security. In a world where digital threats are omnipresent, FortiWeb™ Cloud WAF as a Service emerges as a customer-first solution that not only fortifies web applications and APIs, but also simplifies the security management process. With its cloud advantage, advanced features, and commitment to customer security, FortiWeb™ Cloud WAF is a formidable guardian in the realm of cybersecurity.

Fortinet fixes critical vulnerabilities in FortiNAC and FortiWeb

Cybersecurity vendor Fortinet has addressed two critical vulnerabilities impacting its FortiNAC and FortiWeb products. Cybersecurity firm Fortinet has released security updates to address two critical vulnerabilities in FortiNAC and FortiWeb solutions. The two vulnerabilities, tracked as CVE-2022-39952 and CVE-2021-42756, are respectively an external control of file name or path in Fortinet FortiNAC and a collection […]

Fortinet stopft Schadcode-Lücken in Netzwerk-Produkten

Angreifer könnten unberechtigt unter anderem auf FortiManager zugreifen. Sicherheitsupdates stehen zum Download bereit.

Fortinet: Wichtiges Sicherheitsupdate für FortiWeb OS in Vorbereitung

Für eine Lücke mit High-Einstufung liegt Exploit-Code vor, Fixes kommen aber erst Ende August. Betreiber von FortiWeb WAFs sollten Vorsichtsmaßnahmen treffen.