Full Report
Fortinet has silently patched a critical zero-day vulnerability in its FortiWeb web application firewall, which is now being widely exploited. [...]
Analysis Summary
# Vulnerability: FortiWeb Path Confusion Leading to Unauthenticated Admin Account Creation
## CVE Details
- CVE ID: CVE-2025-64446
- CVSS Score: Not explicitly stated, but described as **critical** and **widely exploited**.
- CWE: Path Confusion/Traversal leading to command execution (Implied).
## Affected Systems
- Products: FortiWeb web application firewall (GUI component)
- Versions:
- 8.0.0 through 8.0.1
- 7.6.0 through 7.6.4
- 7.4.0 through 7.4.9
- 7.2.0 through 7.2.11
- 7.0.0 through 7.0.11
- Configurations: Internet-exposed devices with accessible management interfaces.
## Vulnerability Description
A path confusion vulnerability resides within the GUI component of FortiWeb. This flaw allows unauthenticated attackers to bypass security controls by sending crafted HTTP or HTTPS requests to a specific endpoint (`/api/v2.0/cmdb/system/admin%3f/../../../../../cgi-bin/fwbcgi`). Successful exploitation allows the attacker to execute administrative commands, specifically to create new local administrative user accounts.
## Exploitation
- Status: **Exploited in the wild** (Described as "massively exploited").
- Complexity: **Low** (Implied by the existence of public PoCs and observed widespread exploitation).
- Attack Vector: Network (via crafted HTTP/HTTPS requests).
## Impact
- Confidentiality: **High** (Ability to create admin accounts suggests potential for data access).
- Integrity: **High** (Ability to execute administrative commands and create unauthorized accounts).
- Availability: **Medium to High** (Potential for system disruption or persistence mechanisms).
## Remediation
### Patches
The vulnerability was silently patched before public disclosure. Administrators must upgrade to versions equal to or greater than:
- FortiWeb 8.0.2 or above
- FortiWeb 7.6.5 or above
- FortiWeb 7.4.10 or above
- FortiWeb 7.2.12 or above
- FortiWeb 7.0.12 or above
### Workarounds
Administrators who cannot immediately upgrade should take the following actions:
1. Disable HTTP or HTTPS access for all internet-facing management interfaces.
2. Restrict management interface access strictly to trusted internal networks.
## Detection
- Indicators of Compromise (IOCs):
- Unauthorized creation of new administrator accounts.
- Unexpected modifications to system configuration files.
- Presence of specific traffic patterns targeting paths related to administrative APIs, similar to those used in initial reports (`/api/v2.0/cmdb/system/admin%3f/...`).
- Detection Methods and Tools:
- Review system/configuration logs for signs of unauthorized administrative activity.
- Monitor network traffic for crafted requests against the FortiWeb management interface.
- WatchTowr Labs released the "[FortiWeb Authentication Bypass Artifact Generator](https://github.com/watchtowrlabs/watchTowr-vs-Fortiweb-AuthBypass)" tool to assist defenders in checking for vulnerability artifacts.
## References
- Vendor Advisory: [Fortinet Security Advisory (FG-IR-25-910)](https://fortiguard.fortinet.com/psirt/FG-IR-25-910)
- Related PoC/Exploit Demo: [github com/watchtowrlabs/watchTowr-vs-Fortiweb-AuthBypass](https://github.com/watchtowrlabs/watchTowr-vs-Fortiweb-AuthBypass)