CVE-2025-25257

● Known-exploited CRITICAL ⚠ Exploit

An improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability [CWE-89] vulnerability in Fortinet FortiWeb 7.6.0 through 7.6.3, FortiWeb 7.4.0 through 7.4.7, ...

Affects 1 product across 1 vendor.

CVSS 3.19.8
EPSS99.8%
Percentile100th
PatchPatched
Known-exploited since2025-07-18
CVSS Vector — Plain English Remotely exploitable over the network, low complexity, no authentication required, no user interaction needed, impact contained to the vulnerable component, full confidentiality impact, full integrity impact, full availability impact.
CWE Weakness Definitions
CWE-89: SQL Injection

Attacker inserts SQL commands into application queries through user-controlled input, allowing unauthorized database access.

Related Attack Patterns (CAPEC)
CAPEC-7 Blind SQL Injection
via CWE-89
CAPEC-108 Command Line Execution through SQL Injection
via CWE-89
CAPEC-109 Object Relational Mapping Injection
via CWE-89
CAPEC-110 SQL Injection through SOAP Parameter Tampering
via CWE-89
CAPEC-470 Expanding Control over the Operating System from the Database
via CWE-89
Show all 6
via CWE-89

Mapping is CWE-to-CAPEC per MITRE CAPEC 3.9.

◆ AI Analysis — automated analysis, not human-reviewed

A critical SQL Injection vulnerability exists in multiple versions of Fortinet FortiWeb, allowing unauthenticated attackers to execute unauthorized SQL commands via crafted HTTP or HTTPS requests. This vulnerability has a CVSS score of 9.8 and is listed in the KEV catalog with public proof-of-concept (PoC) and exploits available. Immediate action is required to mitigate the risk of potential attacks.

BSID: BS-2025-GLOBAL-270473-C • Model: Qwen/Qwen2.5-72B-Instruct-AWQ • Confidence: HIGH

Is this CVE in your environment?

BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.

Check My Environment →
Frequently Asked Questions
What is CVE-2025-25257?
A critical SQL Injection vulnerability exists in multiple versions of Fortinet FortiWeb, allowing unauthenticated attackers to execute unauthorized SQL commands via crafted HTTP or HTTPS requests. This vulnerability has a CVSS score of 9.8 and is listed in the KEV catalog with public proof-of-concept (PoC) and exploits available. Immediate action is required to mitigate the risk of potential attacks.
What is the CVSS score for CVE-2025-25257?
CVE-2025-25257 has CVSS 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS: 99.8%.
Is CVE-2025-25257 actively exploited?
Yes. CVE-2025-25257 is in the CISA known-exploited catalog (added 2025-07-18). Active exploitation confirmed. Immediate patching required.
How do I remediate CVE-2025-25257?
Priority: IMMEDIATE. Advisory: https://fortiguard.fortinet.com/psirt/FG-IR-25-151 PSIRT: [email protected]
What systems are affected by CVE-2025-25257?
CVE-2025-25257 affects Fortinet Fortiweb.
What NERC-CIP standard applies to CVE-2025-25257?
NERC CIP CIP-007 CIP-007-R2: This CVE violates CIP-007-R2 as it allows unauthorized access to the control system, which could lead to the compromise of critical assets and operations.
What IEC 62443 requirement maps to CVE-2025-25257?
IEC 62443 SR 7.6: This CVE maps to SR 7.6 because it involves a vulnerability that can be exploited to gain unauthorized access to the system, which is a key security requirement for protecting against such threats.
Vulnerability Details
CVE IDCVE-2025-25257
BSIDBS-2025-GLOBAL-270473-C BreachSpider Global ID
CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Published2025-07-17
Last Modified2026-02-20
ICS Relevance55%
Weakness (CWE)
SQL Injection
Domains
NETWORK-INFRA
SourceNVD
Official Description

An improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability [CWE-89] vulnerability in Fortinet FortiWeb 7.6.0 through 7.6.3, FortiWeb 7.4.0 through 7.4.7, FortiWeb 7.2.0 through 7.2.10, FortiWeb 7.0.0 through 7.0.10 allows an unauthenticated attacker to execute unauthorized SQL code or commands via crafted HTTP or HTTPs requests.

Source: NIST NVD / MITRE CVE Database

Attack Vector Analysis — CITED Relevance

The vulnerability arises from improper neutralization of special elements used in SQL commands. An unauthenticated attacker can exploit this by sending crafted HTTP or HTTPS requests to the affected FortiWeb devices, leading to the execution of unauthorized SQL code or commands. This can result in data theft, system compromise, and other severe impacts.

Exploitation Likelihood: CRITICAL

Affected Products
VendorProductAffected Versions
Fortinet Fortiweb ≥ 7.0.0, < 7.0.11 ≥ 7.2.0, < 7.2.11 ≥ 7.4.0, < 7.4.8 ≥ 7.6.0, < 7.6.4
Remediation
View Vendor Advisory →

Remediation Priority: IMMEDIATE

Vendor PSIRT: [email protected]
Threat Intelligence
● Threat Intelligence Validated: October 2026 | Threat Age: 455 Days
CISA known-exploited● Active Exploitation Confirmed (added 2025-07-18)
Public Exploit⚠ Available — Reference
PoC CodeNot confirmed
● Compensating Controls — AI-drafted, review before deploying MEDIUM CONFIDENCE

Implement strict input validation and sanitization on all web application inputs to prevent SQL injection attacks. Consider using parameterized queries or prepared statements to further mitigate the risk.

No reliable network detection signature exists for this vulnerability class — apply the compensating controls above and the vendor patch. A network rule is only drafted when a concrete on-the-wire signature can be grounded in the advisory.

NERC CIP: CIP-007 CIP-007-R2
This CVE violates CIP-007-R2 as it allows unauthorized access to the control system, which could lead to the compromise of critical assets and operations.
IEC 62443: SR 7.6
This CVE maps to SR 7.6 because it involves a vulnerability that can be exploited to gain unauthorized access to the system, which is a key security requirement for protecting against such threats.

Drafted by AI and not validated for your network. Test in an isolated environment before any production deployment. Compensating control only - does not replace vendor patch.

AI Enrichment Record — provenance & audit hash
ModelQwen/Qwen2.5-72B-Instruct-AWQ
ConfidenceHIGH
Enriched At2026-05-24
SHA-512 Audit Hash8c9037073ad5ab8dcebdb4ef137197a163365a5d43228fc490e2d723d1eee575cf04b6e83a4d074f21a48b1729e2012de707c0eee3112c3af36081466a79e0a7
Related CVEs affecting Fortinet
CVE-2005-3057 10.0 The FTP component in FortiGate 2.8 running FortiOS 2.8MR10 and v3beta, and ot... CVE-2026-26084 9.9 A improper access control vulnerability in Fortinet FortiSandbox 5.0.0 throug... CVE-2021-24020 9.8 A missing cryptographic step in the implementation of the hash digest algorit... CVE-2021-32588 9.8 A use of hard-coded credentials (CWE-798) vulnerability in FortiPortal versio... CVE-2023-25610 9.8 A buffer underwrite ('buffer underflow') vulnerability in the administrative ...
View all Fortinet CVEs →

This Vulnerability Is Being Actively Exploited

CVE-2025-25257 is on the CISA known-exploited list - confirmed active exploitation in the wild. BreachSpider flags known-exploited CVEs on the ICS assets they affect, with known-exploited status synced daily from CISA.

Create a free account →