🔴 CVE-2025-58034

OS command injection vulnerability in Fortinet FortiWeb allowing authenticated attackers to execute unauthorized code via crafted HTTP requests or CLI commands. FortiWeb is a web application firewall that is almost universally deployed as an internet-facing service to protect web applications.

← Back to Overview
HIGH_RISK
Risk Level
6.7
CVSS Score
NETWORK
Attack Vector
Initial Access
ATT&CK Tactic
T1190 — Exploit Public-Facing Application
ATT&CK Technique
VERY_HIGH
Deployment Risk
No
Ransomware

📋 Vulnerability Details

Data Source: CIRCL

Confidence: HIGH

Exploitation Method: DIRECT_NETWORK

CVE Published: 2025-11-18

Added to CISA KEV: 2025-11-18 0 DAY BETWEEN CVE AND KEV

🎯 Recommendations:

🔍 Web Intelligence (Kagi · 2025-11-18)

CVE-2025-58034 is a high-severity OS command injection vulnerability affecting Fortinet FortiWeb [2]. Here's what is known about its exploitation:

  • Affected Applications/Services: The vulnerability affects FortiWeb, a web application firewall designed to protect web applications from various attacks [2].
  • Active Exploitation: It is being actively exploited in attacks [3].
  • Attack Vectors/Exploitation Methods: Authenticated attackers can achieve code execution by exploiting this OS command injection vulnerability through crafted HTTP requests or CLI commands [3][1]. The attacks are considered low complexity [3].
  • Targeted Attacks: While the provided information confirms active exploitation, it does not specifically detail whether the vulnerability has been used in targeted attacks.
  • CISA KEV Status: As of November 18, 2025, this CVE is not listed on CISA's Known Exploited Vulnerabilities Catalog.
  • Technical Details: CVE-2025-58034 involves improper neutralization of special elements used in an OS command, allowing authenticated attackers to execute unauthorized code on the underlying system [1].
Fortinet has released security updates to address this zero-day vulnerability [3].

Sources

  1. CVE-2025-58034 — Fortiweb | dbugs

    Details on CVE-2025-58034: Fortiweb. Includes CVSS score, affected versions, and references.An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability [CWE-78] in Fortinet FortiWeb 8.0.0 through 8.0.1, FortiWeb 7.6.0 through 7.6.5, FortiWeb 7.4.0 thro…

  2. Fortinet FortiWeb CVE-2025-58034 OS Command Injection – Brief Summary ...

    CVE-2025-58034 is a high-severity OS command injection vulnerability in Fortinet FortiWeb, potentially allowing authenticated attackers to run arbitrary commands on the underlying system. FortiWeb is Fortinet's dedicated web application firewall, widely deployed to protect web applications from a ra…

  3. Fortinet warns of new FortiWeb zero-day exploited in attacks

    Today, Fortinet released security updates to patch a new FortiWeb zero-day vulnerability that threat actors are actively exploiting in attacks. Tracked as CVE-2025-58034, this web application ...

Generated by PatchNow Intelligence System

Analysis based on CIRCL.LU data, Claude AI assessment, and MITRE ATT&CK framework

📄 Download JSON Data | 📡 RSS Feed