CVE-2025-64153
published 2025-12-09CVE-2025-64153: A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiExtender 7.6.0 through 7.6.3, FortiExtender 7.4.0…
PriorityP356high7.2CVSS 3.1
AVNACLPRHUINSUCHIHAH
EPSS
1.71%
77.2th percentile
A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiExtender 7.6.0 through 7.6.3, FortiExtender 7.4.0 through 7.4.7, FortiExtender 7.2 all versions, FortiExtender 7.0 all versions may allow an authenticated attacker to execute unauthorized code or commands via a specific HTTP request.
Affected
11 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| fortinet | fortiextender | — | — |
| fortinet | fortiextender | 7.0.0 – 7.0.5 | — |
| fortinet | fortiextender | 7.2.0 – 7.2.5 | — |
| fortinet | fortiextender | 7.4.0 – 7.4.7 | — |
| fortinet | fortiextender | 7.6.0 – 7.6.3 | — |
| fortinet | fortiextender_firmware | 7.0.0 – 7.0.4 | — |
| fortinet | fortiextender_firmware | 7.2.0 – 7.2.5 | — |
| fortinet | fortiextender_firmware | 7.4.0 – 7.4.7 | — |
| fortinet | fortiextender_firmware | 7.6.0 – 7.6.3 | — |
| fortinet | fortiextenderfirmware | — | — |
| fortinet | fortinet | — | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Fortinet
Multiple authenticated OS Command Injections via API
vendor_fortinet·2025-12-09·CVSS 7.2
CVE-2025-64153 [HIGH] CWE-78 Multiple authenticated OS Command Injections via API
FG-IR-25-739: Multiple authenticated OS Command Injections via API
A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiExtender 7.6.0 through 7.6.3, FortiExtender 7.4.0 through 7.4.7, FortiExtender 7.2 all versions, FortiExtender 7.0 all versions may allow an authenticated attacker to execute unauthorized code or commands via a specific HTTP request.
CVEs: CVE-2025-64153
CWEs: CWE-78
CVSS: 7.2 (high)
Affected products: FortiExtender, FortiExtenderfirmware, Fortinet
GHSA
GHSA-8mx4-2q4g-c4v9: A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiExtender 7
ghsa_unreviewed·2025-12-09
CVE-2025-64153 [HIGH] CWE-78 GHSA-8mx4-2q4g-c4v9: A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiExtender 7
A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiExtender 7.6.0 through 7.6.3, FortiExtender 7.4.0 through 7.4.7, FortiExtender 7.2 all versions, FortiExtender 7.0 all versions may allow an authenticated attacker to execute unauthorized code or commands via a specific HTTP request.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2025-12-09
Published