CVE-2025-64153 — OS Command Injection in Fortinet Fortiextender

CWE-78 — OS Command Injection4 documents4 sources
Severity
7.2HIGHNVD
EPSS
0.2%
top 59.81%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Fortinet FortiextenderFortinet Fortiextender Firmware
Timeline
PublishedDec 9

Description

A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiExtender 7.6.0 through 7.6.3, FortiExtender 7.4.0 through 7.4.7, FortiExtender 7.2 all versions, FortiExtender 7.0 all versions may allow an authenticated attacker to execute unauthorized code or commands via a specific HTTP request.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:HExploitability: 1.2 | Impact: 5.9

Affected Packages2 packages

▶CVEListV5fortinet/fortiextender7.6.0 — 7.6.3+3
▶NVDfortinet/fortiextender_firmware7.0.0 — 7.0.4+3

🔴Vulnerability Details

2
CVEList
CVE-2025-64153: A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiExtender 7↗2025-12-09
▶
GHSA
GHSA-8mx4-2q4g-c4v9: A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiExtender 7↗2025-12-09
▶

📋Vendor Advisories

1
Fortinet
Multiple authenticated OS Command Injections via API↗2025-12-09
▶
CVE-2025-64153 — OS Command Injection in Fortinet | cvebase