Cyber Resilience

CVE-2025-58325

Fortinet Fortios 6.4.0 – 7.0.16

Published
14 October 2025
Modified
14 October 2025
Patch / advisory
CVSS Score v3.1 8.2
Click a component to see what it means
Raw vectorCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
EPSS Score 0.0029 21th percentile
Risk Priority 55 floored blend · peak EPSS

Summary

CVE-2025-58325 is a high-severity Incorrect Provision of Specified Functionality (CWE-684) vulnerability in Fortinet Fortios. Its CVSS base score is 8.2 (High).

Operationally, ranked at the 21th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to AC-6 (Least Privilege) and SI-10 (Information Input Validation) — see the control section below for these in your framework.

EU & UK References

Vulnerability Data

An Incorrect Provision of Specified Functionality vulnerability [CWE-684] in FortiOS 7.6.0, 7.4.0 through 7.4.5, 7.2.5 through 7.2.10, 7.0.0 through 7.0.15, 6.4 all versions may allow a local authenticated attacker to execute system commands via crafted CLI commands.

CWE(s)

Related Threats

CVEs Like This One

CVE-2020-12812Same product: Fortinet Fortios
CVE-2023-46717Same product: Fortinet Fortios
CVE-2023-46714Same product: Fortinet Fortios
CVE-2016-1909Same product: Fortinet Fortios
CVE-2024-26007Same product: Fortinet Fortios
CVE-2024-32122Same product: Fortinet Fortios
CVE-2025-53844Same product: Fortinet Fortios
CVE-2023-28001Same product: Fortinet Fortios
CVE-2025-25252Same product: Fortinet Fortios
CVE-2023-33301Same product: Fortinet Fortios

Affected Assets

fortinet
fortios
7.6.0 · 6.4.0 — 7.0.16 · 7.2.0 — 7.2.11 · 7.4.0 — 7.4.6

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)
  • AC-6 Least Privilege
  • SI-10 Information Input Validation
  • AC-3 Access Enforcement
Detect
Catch it (NIST detect / respond)

Harden
Shrink the surface (DISA STIG)
  • 1 hardening rule · 1 OS baseline
Validate
Prove the fix (OWASP ASVS)

Mitigating Controls (NIST 800-53 r5) AI

prevent

Least privilege directly restricts the set of CLI commands and system functions a local authenticated user is permitted to invoke, blocking the crafted-command escalation path.

prevent

Input validation on CLI commands would reject or sanitize the malformed inputs that trigger unintended system-command execution.

prevent

Access enforcement mechanisms ensure only explicitly authorized operations are performed, limiting the impact of the incorrect functionality provision.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 mostly match
prevents

Secure SDLC practices directly enforce spec-compliant functionality and testing, while eliminating this weakness fulfills only part of the control's broader monitoring intent.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

detects

Security testing in development and acceptance validates that implemented functionality conforms to specifications before release.

prevents

Secure development life cycle includes requirements and verification activities that directly reduce the risk of delivering functionality that deviates from published specifications.

prevents

Explicit application security requirements and acceptance criteria help ensure the delivered software matches its intended specifications.

prevents

Change management processes reduce the chance of unintended functional deviations during updates, though they do not directly address initial specification conformance.

References