CVE-2025-58034 is an OS Command Injection vulnerability (CWE-78) affecting multiple versions of Fortinet FortiWeb, including 8.0.0-8.0.1, 7.6.0-7.6.5, 7.4.0-7.4.10, and 7.0.0-7.0.11. This flaw allows an authenticated attacker to execute arbitrary code on the underlying system through specially crafted HTTP requests or CLI commands. Rated with a CVSS score of 7.2 (HIGH), the vulnerability has a network attack vector, low attack complexity, and high impact on confidentiality, integrity, and availability. The vulnerability is actively exploited in the wild, as confirmed by its inclusion in CISA's KEV catalog and multiple media reports. Publicly available exploit code, including a Metasploit module for unauthenticated RCE, exists. The CVE has garnered significant community attention with 38 mentions and 10 media articles, indicating widespread awareness and concern.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 7.0.0, < 7.0.12CPE matchmatch criteria | cpe:2.3:a:fortinet:fortiweb:*:*:*:*:*:*:*:* | ||
>= 7.2.0, < 7.2.12CPE matchmatch criteria | cpe:2.3:a:fortinet:fortiweb:*:*:*:*:*:*:*:* | ||
>= 7.4.0, < 7.4.11CPE matchmatch criteria | cpe:2.3:a:fortinet:fortiweb:*:*:*:*:*:*:*:* | ||
>= 7.6.0, < 7.6.6CPE matchmatch criteria | cpe:2.3:a:fortinet:fortiweb:*:*:*:*:*:*:*:* | ||
>= 8.0.0, < 8.0.2CPE matchmatch criteria | cpe:2.3:a:fortinet:fortiweb:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.3 GitHub mentions.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.