{"id":"CVE-2025-64153","state":"PUBLISHED","title":"A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiExtender 7.6.0 through 7.6.3, FortiExtender 7.4.0 through 7.4.7, Forti","description":"A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiExtender 7.6.0 through 7.6.3, FortiExtender 7.4.0 through 7.4.7, FortiExtender 7.2 all versions, FortiExtender 7.0 all versions may allow an authenticated attacker to execute unauthorized code or commands via a specific HTTP request.","publishedAt":"2025-12-09T17:18:45.909Z","updatedAt":"2026-01-14T09:17:27.371Z","severity":{"score":6.7,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C","source":"fortinet"},"assigner":"fortinet","products":["Fortinet FortiExtender"],"affected":[{"vendor":"Fortinet","product":"FortiExtender","defaultStatus":"unaffected","versions":[{"version":"7.6.0","status":"affected","lessThanOrEqual":"7.6.3","versionType":"semver"},{"version":"7.4.0","status":"affected","lessThanOrEqual":"7.4.7","versionType":"semver"},{"version":"7.2.0","status":"affected","lessThanOrEqual":"7.2.5","versionType":"semver"},{"version":"7.0.0","status":"affected","lessThanOrEqual":"7.0.5","versionType":"semver"}],"cpes":["cpe:2.3:a:fortinet:fortiextender:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiextender:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiextender:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiextender:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiextender:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiextender:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiextender:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiextender:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiextender:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiextender:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiextender:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiextender:7.4.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiextender:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiextender:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiextender:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiextender:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiextender:7.2.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiextender:7.2.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiextender:7.0.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiextender:7.0.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiextender:7.0.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiextender:7.0.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiextender:7.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiextender:7.0.0:*:*:*:*:*:*:*"]}],"references":["https://fortiguard.fortinet.com/psirt/FG-IR-25-739"],"weaknesses":["CWE-78"],"ingestedAt":"2026-10-29T20:09:48.677Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2025/64xxx/CVE-2025-64153.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2025-64153","state":"PUBLISHED","datePublished":"2025-12-09T17:18:45.909Z","dateUpdated":"2026-01-14T09:17:27.371Z","assignerShortName":"fortinet","assignerOrgId":"6abe59d8-c742-4dff-8ce8-9b0ca1073da8","dateReserved":"2025-10-28T12:26:50.749Z"},"containers":{"cna":{"descriptions":[{"lang":"en","value":"A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiExtender 7.6.0 through 7.6.3, FortiExtender 7.4.0 through 7.4.7, FortiExtender 7.2 all versions, FortiExtender 7.0 all versions may allow an authenticated attacker to execute unauthorized code or commands via a specific HTTP request."}],"affected":[{"vendor":"Fortinet","product":"FortiExtender","defaultStatus":"unaffected","versions":[{"version":"7.6.0","status":"affected","lessThanOrEqual":"7.6.3","versionType":"semver"},{"version":"7.4.0","status":"affected","lessThanOrEqual":"7.4.7","versionType":"semver"},{"version":"7.2.0","status":"affected","lessThanOrEqual":"7.2.5","versionType":"semver"},{"version":"7.0.0","status":"affected","lessThanOrEqual":"7.0.5","versionType":"semver"}],"cpes":["cpe:2.3:a:fortinet:fortiextender:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiextender:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiextender:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiextender:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiextender:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiextender:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiextender:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiextender:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiextender:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiextender:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiextender:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiextender:7.4.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiextender:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiextender:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiextender:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiextender:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiextender:7.2.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiextender:7.2.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiextender:7.0.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiextender:7.0.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiextender:7.0.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiextender:7.0.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiextender:7.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiextender:7.0.0:*:*:*:*:*:*:*"]}],"references":[{"url":"https://fortiguard.fortinet.com/psirt/FG-IR-25-739","name":"https://fortiguard.fortinet.com/psirt/FG-IR-25-739"}],"metrics":[{"format":"CVSS","cvssV3_1":{"version":"3.1","attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":6.7,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-78","lang":"en","description":"Execute unauthorized code or commands","type":"CWE"}]}],"providerMetadata":{"shortName":"fortinet","orgId":"6abe59d8-c742-4dff-8ce8-9b0ca1073da8","dateUpdated":"2026-01-14T09:17:27.371Z"},"solutions":[{"lang":"en","value":"Upgrade to FortiExtender version 7.6.4 or above\nUpgrade to FortiExtender version 7.4.8 or above"}]},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2025-12-09T20:21:16.823596Z","id":"CVE-2025-64153","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-12-09T20:43:33.205Z"}}]}}}