CVE-2025-58034
Fortinet FortiWeb OS Command Injection Vulnerability
Description
CVE-2025-58034 is a high-severity OS command injection vulnerability in Fortinet FortiWeb, a web application firewall (WAF) and API protection platform. The vulnerability affects multiple FortiWeb version branches from 7.0.0 through 8.0.1, allowing an authenticated attacker with administrative privileges to execute unauthorized code on the underlying operating system through crafted HTTP requests. With a CVSS v3.1 base score of 7.2, this command injection compromises the integrity of the security device itself. CISA has added CVE-2025-58034 to the Known Exploited Vulnerabilities catalog with a remediation deadline of November 25, 2025, and the EPSS score of 49.74% at the 97.7th percentile indicates exceptionally high exploitation probability, placing it among the most actively targeted network security appliance vulnerabilities.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| fortinet | fortiweb | >= 7.0.0, < 7.0.12; >= 7.2.0, < 7.2.12; >= 7.4.0, < 7.4.11; >= 7.6.0, < 7.6.6; >= 8.0.0, < 8.0.2 |
References
- https://fortiguard.fortinet.com/psirt/FG-IR-25-513(Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-58034(US Government Resource)
Weakness Type
CWE-78: OS Command Injection
CVE-2025-58034 is classified under CWE-78 (Improper Neutralization of Special Elements used in an OS Command), a critical weakness that enables attackers to inject and execute arbitrary operating system commands through an application. In FortiWeb, certain administrative functions construct system-level commands that incorporate user-supplied input from HTTP requests. The application fails to properly neutralize shell metacharacters in these inputs, allowing an authenticated administrator to append or inject additional commands that the operating system executes. OS command injection in a web application firewall is particularly ironic and dangerous because the compromised device is specifically designed to protect other applications from attacks, and its compromise undermines the entire security architecture. Learn more about CWE-78
Impact Analysis
The compromise of a FortiWeb appliance through CVE-2025-58034 has cascading security implications that extend far beyond the device itself. Confidentiality is rated as high impact because OS command execution on the FortiWeb appliance provides access to all WAF configurations, SSL/TLS certificates and private keys, protected application traffic passing through the device, authentication credentials, and the internal network topology visible from the WAF's vantage point.
Integrity faces high impact as an attacker with command execution on the WAF can modify security policies to allow malicious traffic, disable protection rules, inject malicious content into proxied traffic, plant persistent backdoors, and effectively turn the security device into an attack platform. A compromised WAF that appears to be functioning normally but has weakened or disabled protections is an extremely dangerous situation.
Availability is critically threatened since the attacker can disable the WAF service, causing all protected applications to lose their security layer or become unavailable if the WAF is deployed inline. The EPSS score of 49.74% at the 97.7th percentile places this in the top 3% of all vulnerabilities for exploitation probability. The ransomware association is classified as unknown, but Fortinet devices are consistently targeted by threat actors given their prevalence in enterprise networks and the strategic value of compromising network security infrastructure.
Exploit Maturity
CVE-2025-58034 demonstrates very high exploit maturity. The EPSS score of 49.74% at the 97.7th percentile indicates that exploitation is extremely likely, placing it among the most targeted vulnerabilities in the current landscape. CISA has confirmed active exploitation through KEV catalog inclusion.
Fortinet has published an official advisory at FG-IR-25-513 detailing the vulnerability and providing patch information. The ransomware association is classified as unknown, but Fortinet appliances have been repeatedly targeted by ransomware operators and APT groups in recent years, with FortiWeb's position as a web application firewall making it an especially valuable target. Compromise of a WAF gives attackers the ability to monitor and manipulate all web traffic passing through the device while simultaneously disabling the security protections it provides. The authenticated requirement (PR:H) somewhat limits mass exploitation, but administrative credentials for network security devices are frequently obtained through credential stuffing, phishing of IT administrators, or prior compromise of management networks.
Remediation
-
Upgrade FortiWeb immediately to the patched version for your branch: 7.0.12+ for the 7.0.x branch, 7.2.12+ for the 7.2.x branch, 7.4.11+ for the 7.4.x branch, 7.6.6+ for the 7.6.x branch, or 8.0.2+ for the 8.0.x branch. Refer to the Fortinet advisory FG-IR-25-513 for detailed upgrade paths and compatibility information.
-
Restrict management interface access to dedicated management networks or specific trusted IP addresses. FortiWeb administrative interfaces should never be accessible from the internet or general corporate networks. Implement out-of-band management where possible.
-
Rotate all credentials stored on or accessible through the FortiWeb appliance, including administrator passwords, SSL/TLS certificates and private keys, API keys for integrated services, and any authentication credentials used for health checks or backend server communication.
-
Audit FortiWeb configurations for unauthorized changes including modified security policies, new administrator accounts, disabled protection rules, or altered logging configurations. Compare current configurations against known-good baselines to identify any malicious modifications.
-
Implement enhanced monitoring of the FortiWeb management interface by logging all administrative actions and alerting on unusual activity patterns such as configuration changes outside maintenance windows, logins from unexpected IP addresses, or modifications to critical security policies.
Technical Details
CVE-2025-58034 is an OS command injection vulnerability in Fortinet FortiWeb. The CVSS v3.1 vector string is CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, producing a base score of 7.2.
The vector analysis characterizes an authenticated administrative exploitation scenario. Attack Vector (AV:N) confirms remote exploitation over the network through FortiWeb's management interface. Attack Complexity (AC:L) indicates reliable exploitation. Privileges Required (PR:H) requires the attacker to have high-level administrative access to the FortiWeb device, which limits the initial attack surface but does not diminish the impact. User Interaction (UI:N) confirms no additional victim participation is needed. Scope (S:U) indicates the impact is assessed within the FortiWeb component boundary.
The vulnerability exists in FortiWeb's handling of HTTP requests within administrative management functions. When an authenticated administrator submits certain management operations, the FortiWeb application constructs operating system commands that incorporate values from the HTTP request. The affected code paths do not adequately sanitize or escape shell metacharacters, allowing the administrator to inject additional OS commands through crafted HTTP request parameters. The injected commands execute with the privileges of the FortiWeb system process, which typically runs with root-level access on the underlying FortiOS operating system. Affected version ranges span FortiWeb 7.0.0 through 7.0.11, 7.2.0 through 7.2.11, 7.4.0 through 7.4.10, 7.6.0 through 7.6.5, and 8.0.0 through 8.0.1.
Frequently Asked Questions
What is CVE-2025-58034?
CVE-2025-58034 is an OS command injection vulnerability in Fortinet FortiWeb, a web application firewall product. It allows an authenticated administrator to execute arbitrary operating system commands on the underlying system through crafted HTTP requests.
Which FortiWeb versions are affected?
FortiWeb versions 7.0.0 through 7.0.11, 7.2.0 through 7.2.11, 7.4.0 through 7.4.10, 7.6.0 through 7.6.5, and 8.0.0 through 8.0.1 are affected. Organizations should upgrade to 7.0.12, 7.2.12, 7.4.11, 7.6.6, or 8.0.2 respectively.
Why is a web application firewall vulnerability especially dangerous?
A compromised FortiWeb can silently weaken or disable security protections while appearing to function normally. The attacker can also intercept all web traffic passing through the device, access SSL/TLS private keys, and use the WAF's network position to attack protected backend applications.
Does exploitation require administrative credentials?
Yes, the vulnerability requires high-level privileges (PR:H), meaning the attacker needs administrative access to the FortiWeb management interface. However, administrative credentials can be obtained through phishing, credential stuffing, or compromise of the management network.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.