IP-DB.com
Türkçe English Deutsch Español
Anmelden API-Schlüssel holen
7.7Hoch

CVE-2025-52970

Fortinet FortiWeb Veröffentlicht: (vor 1 Jahr)

Beschreibung

A improper handling of parameters vulnerability in Fortinet FortiWeb 7.6.0 through 7.6.3, FortiWeb 7.4.0 through 7.4.7, FortiWeb 7.2.0 through 7.2.10, FortiWeb 7.0.0 through 7.0.10 may allow an unauthenticated remote attacker with non-public information pertaining to the device and targeted user to gain admin privileges on the device via a specially crafted request.

Schwachstellentyp (CWE): CWE-233

Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.

Betroffene Produkte und Versionen

HerstellerProduktVersionen
Fortinet FortiWeb 7.6.0 – ≤ 7.6.3, 7.4.0 – ≤ 7.4.7, 7.2.0 – ≤ 7.2.10, 7.0.0 – ≤ 7.0.10

Referenzen und Patches

CPE-Treffer (NVD) (4)
  • cpe:2.3:a:fortinet:fortiweb:*:*:*:*:*:*:*:* ≥ 7.0.0 < 7.0.11
  • cpe:2.3:a:fortinet:fortiweb:*:*:*:*:*:*:*:* ≥ 7.2.0 < 7.2.11
  • cpe:2.3:a:fortinet:fortiweb:*:*:*:*:*:*:*:* ≥ 7.4.0 < 7.4.8
  • cpe:2.3:a:fortinet:fortiweb:*:*:*:*:*:*:*:* ≥ 7.6.0 < 7.6.4

Neue CVEs im selben Produkt — Fortinet (all products)

9.0Kritisch
CVE-2026-126261
Fortinet FortiManager

A improper authorization vulnerability in Fortinet FortiManager 8.0.0, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.5, FortiManager 7.2.0 through 7.2.8 may allow an unauthenticated attacker that can reach the FGFM port to execute code or c…

7.3Hoch
CVE-2025-61625
Fortinet FortiManager; Fortinet FortiAnalyzer; Fortinet FortiManager Cloud

An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.4, FortiAnalyzer 7.4.0 through 7.4.7, FortiAnalyzer 7.2.0 through 7.2.11, FortiManager 7.6.0 through 7.6.4, FortiManage…

7.9Hoch
CVE-2026-26248
Fortinet FortiSandbox; Fortinet FortiSandbox Cloud; Fortinet FortiSandbox PaaS

A improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4.0 through 4.4.8, FortiSandbox 4.2 all versions, FortiSandbox Cloud 5.0.4 through 5.0.5, FortiSa…

5.9Mittel
CVE-2026-121530
Fortinet FortiOS

A improper authentication vulnerability in Fortinet FortiOS 7.6.0 through 7.6.6 may allow a remote authenticated attacker to gain improper access control via an invalid token after entering a valid username and password

6.7Mittel
CVE-2026-106174
Fortinet FortiOS; Siemens RUGGEDCOM APE1808

A improper locking vulnerability in Fortinet FortiOS 8.0.0, FortiOS 7.6.4 through 7.6.6 may allow an unauthenticated attacker with network access to the device to cause a denial of service of the HTTPS management interface via crafted HTTP requests.

9.6Kritisch
CVE-2026-107656
Fortinet FortiSandbox; Fortinet FortiSandbox PaaS

An authentication bypass using an alternate path or channel vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.6, FortiSandbox 4.4.0 through 4.4.9, FortiSandbox 4.2 all versions, FortiSandbox PaaS 5.0.0 through 5.0.6, FortiSandbox PaaS 4.4 all versions,…