CVE-2025-58325 — Incorrect Provision of Specified Functionality in Fortinet Fortios

CWE-684 — Incorrect Provision of Specified Functionality4 documents4 sources
Severity
6.7MEDIUMNVD
CNA8.2
EPSS
0.0%
top 95.23%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Fortinet Fortios
Timeline
PublishedOct 14

Description

An Incorrect Provision of Specified Functionality vulnerability [CWE-684] in FortiOS 7.6.0, 7.4.0 through 7.4.5, 7.2.5 through 7.2.10, 7.0.0 through 7.0.15, 6.4 all versions may allow a local authenticated attacker to execute system commands via crafted CLI commands.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:HExploitability: 0.8 | Impact: 5.9

Affected Packages2 packages

▶NVDfortinet/fortios6.4.0 — 7.0.16+3
▶CVEListV5fortinet/fortios7.4.0 — 7.4.5+4

🔴Vulnerability Details

2
CVEList
CVE-2025-58325: An Incorrect Provision of Specified Functionality vulnerability [CWE-684] in FortiOS 7↗2025-10-14
▶
GHSA
GHSA-q837-wq3x-6687: An Incorrect Provision of Specified Functionality vulnerability [CWE-684] in FortiOS 7↗2025-10-14
▶

📋Vendor Advisories

1
Fortinet
Restricted CLI command bypass↗2025-10-14
▶