IM
IronMonkey Threat Research

CVE-2025-58413 HIGH

Published: 2025-11-18 | Last Modified: 2026-06-09 | Status: Modified

Description

A stack-based buffer overflow vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions, FortiOS 6.2 all versions, FortiOS 6.0 all versions, FortiSASE 25.3.b allows attacker to execute unauthorized code or commands via specially crafted packets

CVSS Metrics

Base Score: 7.5 (HIGH)

CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack VectorADJACENT_NETWORK
Attack ComplexityHIGH
Privileges RequiredNONE
User InteractionNONE
ScopeUNCHANGED
Confidentiality ImpactHIGH
Integrity ImpactHIGH
Availability ImpactHIGH

Source: [email protected]

Type: Secondary

Exploitability Score: 1.6

Impact Score: 5.9

Weaknesses

Source Type Description
[email protected] Secondary
en CWE-121
[email protected] Primary
en CWE-787

Affected Products

Vendor Product Version Update Type
fortinet fortios * <built-in method update of dict object at 0x7d1ea0fae740> Operating System
fortinet fortios * <built-in method update of dict object at 0x7d1ea0faee40> Operating System
fortinet fortisase 25.3.89 <built-in method update of dict object at 0x7d1e357b3480> Application
fortinet fortisase 25.3.89 <built-in method update of dict object at 0x7d1e64be7940> Application

Affected Configurations

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*
Yes cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:a:fortinet:fortisase:25.3.89:*:*:*:feature:*:*:*
Yes cpe:2.3:a:fortinet:fortisase:25.3.89:*:*:*:mature:*:*:*

References

Notification
Message here