CVE-2025-64153: Multiple authenticated OS Command Injections via API
A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiExtender 7.6.0 through 7.6.3, FortiExtender 7.4.0 through 7.4.7, FortiExtender 7.2 all versions, FortiExtender 7.0 all versions may allow an authenticated attacker to execute unauthorized code or commands via a specific HTTP request.
Other sources
An OS command injection vulnerabtility [CWE-78] in FortiExtender API may allow an authenticated attacker to execute unauthorized code or commands via a specific HTTP request.
— FortiGuard
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the severity of CVE-2025-64153?
CVE-2025-64153 is classified as a high-severity vulnerability due to its potential for OS command injection by authenticated attackers.
How do I fix CVE-2025-64153?
To remediate CVE-2025-64153, upgrade FortiExtender to versions 7.6.4, 7.4.8, or consider newer releases beyond those identified as vulnerable.
Which versions of FortiExtender are affected by CVE-2025-64153?
CVE-2025-64153 affects FortiExtender versions 7.6.0 through 7.6.3, 7.4.0 through 7.4.7, and all versions of 7.2 and 7.0.
Who is the vendor for CVE-2025-64153?
The vendor for CVE-2025-64153 is Fortinet, which develops the FortiExtender product.
What type of vulnerability is CVE-2025-64153?
CVE-2025-64153 is an OS command injection vulnerability due to improper neutralization of special elements in user inputs.