CVE-2025-47857

CWE-78 — OS Command Injection4 documents4 sources
Severity
6.7MEDIUM
EPSS
0.0%
top 90.42%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Fortinet Fortiweb
Timeline
PublishedAug 12

Description

A improper neutralization of special elements used in an os command ('os command injection') vulnerability [CWE-78] in Fortinet FortiWeb CLI version 7.6.0 through 7.6.3 and before 7.4.8 allows a privileged attacker to execute arbitrary code or command via crafted CLI commands.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:HExploitability: 0.8 | Impact: 5.9

Affected Packages2 packages

▶NVDfortinet/fortiweb7.4.1 — 7.4.9+1
▶CVEListV5fortinet/fortiweb7.6.0 — 7.6.3+1

🔴Vulnerability Details

2
CVEList
CVE-2025-47857: A improper neutralization of special elements used in an os command ('os command injection') vulnerability [CWE-78] in Fortinet FortiWeb CLI version 7↗2025-08-12
▶
GHSA
GHSA-9wp6-c53h-c89m: A improper neutralization of special elements used in an os command ('os command injection') vulnerability [CWE-78] in Fortinet FortiWeb CLI version 7↗2025-08-12
▶

📋Vendor Advisories

1
Fortinet
A improper neutralization of special elements used in an os command ('os command injection') vulnerability [CWE-78] in F...↗2025-08-12
▶
CVE-2025-47857 (MEDIUM CVSS 6.7) | A improper neutralization of specia | cvebase.io