CVE-2025-52970: High severity Fortinet FortiWeb vulnerability
A improper handling of parameters in Fortinet FortiWeb versions 7.6.3 and below, versions 7.4.7 and below, versions 7.2.10 and below, and 7.0.10 and below may allow an unauthenticated remote attacker with non-public information pertaining to the device and targeted user to gain admin privileges on the device via a specially crafted request.
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the severity of CVE-2025-52970?
CVE-2025-52970 is rated as a critical vulnerability due to the potential for unauthenticated remote attackers to gain admin privileges.
How do I fix CVE-2025-52970?
To mitigate CVE-2025-52970, upgrade to a patched version of Fortinet FortiWeb beyond 7.6.3, 7.4.7, 7.2.10, or 7.0.10.
What products are affected by CVE-2025-52970?
CVE-2025-52970 affects Fortinet FortiWeb versions 7.6.3 and below, 7.4.7 and below, 7.2.10 and below, and 7.0.10 and below.
Can CVE-2025-52970 be exploited remotely?
Yes, CVE-2025-52970 allows unauthenticated remote attackers to exploit the vulnerability given they have non-public information.
What impact does CVE-2025-52970 have on security?
CVE-2025-52970 can lead to unauthorized access with admin privileges, severely compromising the security of the affected systems.