CVE-2025-25256
CRITICAL EXPLOITED NUCLEIFortinet FortiSIEM - OS Command Injection
Title source: nucleiExploitation Summary
CVE-2025-25256 has been observed exploited in the wild (reported by VulnCheck KEV). EIP tracks 1 public exploit from researchers including watchtowrlabs. A Nuclei detection template is also available.
AI-analyzed exploit summary This repository contains a Python script that exploits CVE-2025-25256, an unauthenticated remote command execution vulnerability in FortiSIEM. The script crafts a malicious XML payload and sends it to the target via SSL socket to trigger command execution.
Description
An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability [CWE-78] in Fortinet FortiSIEM version 7.3.0 through 7.3.1, 7.2.0 through 7.2.5, 7.1.0 through 7.1.7, 7.0.0 through 7.0.3 and before 6.7.9 allows an unauthenticated attacker to execute unauthorized code or commands via crafted CLI requests.
Exploits (1)
This repository contains a Python script that exploits CVE-2025-25256, an unauthenticated remote command execution vulnerability in FortiSIEM. The script crafts a malicious XML payload and sends it to the target via SSL socket to trigger command execution.
Nuclei Templates (1)
http.favicon.hash:-1341442175 || http.html:"var hst = location.hostname"
icon_hash="-1341442175" || body="var hst = location.hostname"
References (4)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H