CVE-2025-52970
Full vulnerability record from the local CVENow database.
Description
A improper handling of parameters vulnerability in Fortinet FortiWeb 7.6.0 through 7.6.3, FortiWeb 7.4.0 through 7.4.7, FortiWeb 7.2.0 through 7.2.10, FortiWeb 7.0.0 through 7.0.10 may allow an unauthenticated remote attacker with non-public information pertaining to the device and targeted user to gain admin privileges on the device via a specially crafted request.
Severity
HIGH
CVSS score
8.1
(v3.1)
Vulnerability status
Modified
Source identifier
Published
2025-08-12 19:15:32.277000
Last modified
2026-11-06 11:17:00.963000
View original CVE JSON
{
"id": "CVE-2025-52970",
"sourceIdentifier": "[email protected]",
"published": "2025-08-12T19:15:32.277",
"lastModified": "2026-11-06T11:17:00.963",
"vulnStatus": "Modified",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A improper handling of parameters vulnerability in Fortinet FortiWeb 7.6.0 through 7.6.3, FortiWeb 7.4.0 through 7.4.7, FortiWeb 7.2.0 through 7.2.10, FortiWeb 7.0.0 through 7.0.10 may allow an unauthenticated remote attacker with non-public information pertaining to the device and targeted user to gain admin privileges on the device via a specially crafted request."
},
{
"lang": "es",
"value": "Un manejo inadecuado de los parámetros en Fortinet FortiWeb versiones 7.6.3 y anteriores, versiones 7.4.7 y anteriores, versiones 7.2.10 y anteriores, y 7.0.10 y anteriores puede permitir que un atacante remoto no autenticado con información no pública perteneciente al dispositivo y al usuario objetivo obtenga privilegios de administrador en el dispositivo a través de una solicitud especialmente manipulada."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "Fortinet",
"product": "FortiWeb",
"defaultStatus": "unaffected",
"cpes": [
"cpe:2.3:a:fortinet:fortiweb:7.6.3:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiweb:7.6.2:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiweb:7.6.1:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiweb:7.6.0:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiweb:7.4.7:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiweb:7.4.6:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiweb:7.4.5:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiweb:7.4.4:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiweb:7.4.3:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiweb:7.4.2:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiweb:7.4.1:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiweb:7.4.0:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiweb:7.2.10:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiweb:7.2.9:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiweb:7.2.8:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiweb:7.2.7:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiweb:7.2.6:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiweb:7.2.5:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiweb:7.2.4:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiweb:7.2.3:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiweb:7.2.2:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiweb:7.2.1:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiweb:7.2.0:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiweb:7.0.10:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiweb:7.0.9:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiweb:7.0.8:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiweb:7.0.7:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiweb:7.0.6:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiweb:7.0.5:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiweb:7.0.4:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiweb:7.0.3:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiweb:7.0.2:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiweb:7.0.1:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiweb:7.0.0:*:*:*:*:*:*:*"
],
"versions": [
{
"version": "7.6.0",
"lessThanOrEqual": "7.6.3",
"versionType": "semver",
"status": "affected"
},
{
"version": "7.4.0",
"lessThanOrEqual": "7.4.7",
"versionType": "semver",
"status": "affected"
},
{
"version": "7.2.0",
"lessThanOrEqual": "7.2.10",
"versionType": "semver",
"status": "affected"
},
{
"version": "7.0.0",
"lessThanOrEqual": "7.0.10",
"versionType": "semver",
"status": "affected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "HIGH",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 2.2,
"impactScore": 5.9
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2025-08-18T12:41:47.892664Z",
"id": "CVE-2025-52970",
"options": [
{
"exploitation": "poc"
},
{
"automatable": "no"
},
{
"technicalImpact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-233"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:fortinet:fortiweb:*:*:*:*:*:*:*:*",
"versionStartIncluding": "7.0.0",
"versionEndExcluding": "7.0.11",
"matchCriteriaId": "7E739890-CFEA-4B7B-B78D-8CC8157BDF54"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:fortinet:fortiweb:*:*:*:*:*:*:*:*",
"versionStartIncluding": "7.2.0",
"versionEndExcluding": "7.2.11",
"matchCriteriaId": "B642678E-4E31-4A6B-A791-ACD5D332B175"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:fortinet:fortiweb:*:*:*:*:*:*:*:*",
"versionStartIncluding": "7.4.0",
"versionEndExcluding": "7.4.8",
"matchCriteriaId": "CA8DE17C-1756-4B18-A956-A52CFA0967B9"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:fortinet:fortiweb:*:*:*:*:*:*:*:*",
"versionStartIncluding": "7.6.0",
"versionEndExcluding": "7.6.4",
"matchCriteriaId": "2B739434-1979-43F9-AEC1-D287B1BCA5CA"
}
]
}
]
}
],
"references": [
{
"url": "https://fortiguard.fortinet.com/psirt/FG-IR-25-448",
"source": "[email protected]",
"tags": [
"Vendor Advisory"
]
},
{
"url": "https://pwner.gg/blog/2025-08-13-fortiweb-cve-2025-52970",
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"tags": [
"Exploit",
"Third Party Advisory"
]
}
]
}