Full Report
More than a month after PoC made public Fortinet finally published a security advisory on Friday for a critical FortiWeb path traversal vulnerability under active exploitation – but it appears digital intruders got a month's head start.…
Analysis Summary
# Vulnerability: Critical FortiWeb Path Traversal Leading to Unauthenticated Command Execution
## CVE Details
- CVE ID: CVE-2025-64446
- CVSS Score: Not explicitly stated, but described as "critical" and leading to "fully take over vulnerable devices."
- CWE: Path Traversal (Inferred from description)
## Affected Systems
- Products: Fortinet FortiWeb (Web Application Firewall)
- Versions: Prior to 8.0.2 (Specifically noted that 8.0.1 is vulnerable)
- Configurations: Appliances connected to the internet.
## Vulnerability Description
The vulnerability is a critical path traversal flaw in FortiWeb. Successful exploitation allows unauthenticated attackers to execute administrative commands on the device. The primary observed exploitation technique involves adding a new administrator account to achieve persistence on the compromised appliance.
## Exploitation
- Status: **Exploited in the wild** (Confirmed by Fortinet and CISA)
- Complexity: Low (Implied by unauthenticated access and widespread exploitation)
- Attack Vector: Network (Remote, unauthenticated)
## Impact
- Confidentiality: High (Potential access to sensitive configuration/traffic data)
- Integrity: High (Ability to execute administrative commands, add persistent accounts)
- Availability: High (Potential for complete device takeover or disruption)
## Remediation
### Patches
- **FortiWeb version 8.0.2** and later contain the fix.
### Workarounds
- No official workarounds were detailed in the provided summary, but the primary advice is immediate patching, as unpatched appliances are considered likely compromised.
## Detection
- Detection methods include utilizing artifacts provided by third-party researchers (e.g., WatchTowr's Detection Artefact Generator).
- Indicators of Compromise (IOCs) would involve monitoring for suspicious administrative account creation activities on FortiWeb devices.
## References
- Vendor Advisory: fortiguard.fortinet.com/psirt/FG-IR-25-910 (Defanged: fortiguard.fortinet.com/psirt/FG-IR-25-910)
- CISA KEV Catalog Entry: cisa.gov/news-events/alerts/2025/11/14/cisa-adds-one-known-exploited-vulnerability-catalog (Defanged: cisa.gov/news-events/alerts/2025/11/14/cisa-adds-one-known-exploited-vulnerability-catalog)
- Third-Party Analysis/PoC: x.com/watchtowrcyber/status/1989017336632996337?s=20 (Defanged: x.com/watchtowrcyber/status/1989017336632996337?s=20)
- Third-Party Analysis/PoC: labs.watchtowr.com/when-the-impersonation-function-gets-used-to-impersonate-users-fortinet-fortiweb-auth-bypass/ (Defanged: labs.watchtowr.com/when-the-impersonation-function-gets-used-to-impersonate-users-fortinet-fortiweb-auth-bypass/)