CVE-2025-67862 MEDIUM

Published: 2026-06-09 | Last Modified: 2026-07-23 | Status: Modified

Description

An Internal Asset Exposed to Unsafe Debug Access Level or State vulnerability [CWE-1244] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.2, FortiOS 7.4.0 through 7.4.7, FortiOS 7.2.0 through 7.2.10, FortiOS 7.0.0 through 7.0.16, FortiOS 6.4 all versions, FortiProxy 7.6.0 through 7.6.3, FortiProxy 7.4.0 through 7.4.10, FortiProxy 7.2.0 through 7.2.14, FortiProxy 7.0 all versions may allow an authenticated admin to execute lua scripts via crafted CLI commands.

Additional Descriptions (1)

Una vulnerabilidad de activo interno expuesto a nivel o estado de acceso de depuración inseguro [CWE-1244] vulnerabilidad en Fortinet FortiOS 7.6.0 hasta 7.6.2, FortiOS 7.4.0 hasta 7.4.7, FortiOS 7.2.0 hasta 7.2.10, FortiOS 7.0.0 hasta 7.0.16, FortiOS 6.4 todas las versiones, FortiProxy 7.6.0 hasta 7.6.3, FortiProxy 7.4.0 hasta 7.4.10, FortiProxy 7.2.0 hasta 7.2.14, FortiProxy 7.0 todas las versiones puede permitir a un administrador autenticado ejecutar scripts lua mediante comandos CLI manipulados.

CVSS Metrics

Base Score: 6.7 (MEDIUM)

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Attack Vector	LOCAL
Attack Complexity	LOW
Privileges Required	HIGH
User Interaction	NONE
Scope	UNCHANGED
Confidentiality Impact	HIGH
Integrity Impact	HIGH
Availability Impact	HIGH

Source: [email protected]

Type: Secondary

Exploitability Score: 0.8

Impact Score: 5.9

Weaknesses

Source	Type	Description
[email protected]	Secondary	en CWE-1244

Affected Products

Vendor	Product	Version	Update	Type
fortinet	fortios	*	<built-in method update of dict object at 0x7fd39c48c5c0>	Operating System
fortinet	fortios	*	<built-in method update of dict object at 0x7fd39c48fc00>	Operating System
fortinet	fortios	*	<built-in method update of dict object at 0x7fd31b2e9880>	Operating System
fortinet	fortios	*	<built-in method update of dict object at 0x7fd36832bd40>	Operating System
fortinet	fortios	*	<built-in method update of dict object at 0x7fd39c48ee00>	Operating System
fortinet	fortiproxy	*	<built-in method update of dict object at 0x7fd39c48d840>	Application
fortinet	fortiproxy	*	<built-in method update of dict object at 0x7fd340a502c0>	Application
fortinet	fortiproxy	*	<built-in method update of dict object at 0x7fd31b2e87c0>	Application
fortinet	fortiproxy	*	<built-in method update of dict object at 0x7fd36832b300>	Application

Affected Configurations

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:fortinet:fortios::::::::`
Yes	`cpe:2.3:o:fortinet:fortios::::::::`
Yes	`cpe:2.3:o:fortinet:fortios::::::::`
Yes	`cpe:2.3:o:fortinet:fortios::::::::`
Yes	`cpe:2.3:o:fortinet:fortios::::::::`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:a:fortinet:fortiproxy::::::::`
Yes	`cpe:2.3:a:fortinet:fortiproxy::::::::`
Yes	`cpe:2.3:a:fortinet:fortiproxy::::::::`
Yes	`cpe:2.3:a:fortinet:fortiproxy::::::::`

References

https://fortiguard.fortinet.com/psirt/FG-IR-26-143
Source: [email protected]

Vendor Advisory
https://cert-portal.siemens.com/productcert/html/ssa-864900.html
Source: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e