CVE-2025-58903: Multiple Unchecked Return Value leading to Null Pointer Dereference
An Unchecked Return Value vulnerability [CWE-252] in Fortinet FortiOS version 7.6.0 through 7.6.3 and before 7.4.8 API allows an authenticated user to cause a Null Pointer Dereference, crashing the http daemon via a specialy crafted request.
Other sources
An Unchecked Return Value vulnerability [CWE-252] in FortiOS API may allow an authenticated user to cause a Null Pointer Dereference, crashing the http daemon via a specialy crafted request.
— FortiGuard
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
FortiOS APIto a version that resolves this vulnerability.Fixed in 7.4.9 - Upgrade
Upgrade
FortiOS APIto a version that resolves this vulnerability.Fixed in 7.6.4 - Upgrade
Upgrade
FortiOS APIto a version that resolves this vulnerability.Fixed in 8.0.0
Event History
Frequently Asked Questions
What is the severity of CVE-2025-58903?
CVE-2025-58903 is classified as a high severity vulnerability due to its potential to cause a denial of service through a Null Pointer Dereference.
How do I fix CVE-2025-58903?
To fix CVE-2025-58903, upgrade Fortinet FortiOS to version 7.6.4 or newer, or ensure you are running version 7.4.8 or higher.
Who is affected by CVE-2025-58903?
CVE-2025-58903 affects users of Fortinet FortiOS versions 7.6.0 to 7.6.3 and any versions lower than 7.4.8.
What type of attack can exploit CVE-2025-58903?
CVE-2025-58903 can be exploited by an authenticated user sending specially crafted requests to the FortiOS API, causing a crash of the http daemon.
Is authentication required to exploit CVE-2025-58903?
Yes, exploitation of CVE-2025-58903 requires the attacker to be an authenticated user of the FortiOS system.