CVE-2025-58034

HIGHCISA KEV

7.2

Description

An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability [CWE-78] vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.1, FortiWeb 7.6.0 through 7.6.5, FortiWeb 7.4.0 through 7.4.10, FortiWeb 7.2.0 through 7.2.11, FortiWeb 7.0.0 through 7.0.11 may allow an authenticated attacker to execute unauthorized code on the underlying system via crafted HTTP requests or CLI commands.

CVE Details

CVSS v3.1 Score7.2

SeverityHIGH

CVSS VectorCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Attack VectorNETWORK

ComplexityLOW

Privileges RequiredHIGH

User InteractionNONE

Published11/18/2025

Last Modified11/21/2025

Sourcekev

Honeypot Sightings0

CISA KEV

VendorFortinet

ProductFortiWeb

Vulnerability NameFortinet FortiWeb OS Command Injection Vulnerability

KEV Date Added2025-11-18

Remediation Due Date2025-11-25

Ransomware UseUnknown

Affected Products

fortinet:fortiweb

Weaknesses (CWE)

CWE-78

References

https://fortiguard.fortinet.com/psirt/FG-IR-25-513(psirt@fortinet.com)

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-58034(134c704f-9b21-4f2e-91b3-4a467353bcc0)

IOC Correlations

No correlations recorded

This product uses data from the NVD API but is not endorsed or certified by the NVD.