CVE-2025-47856CWE-78command-injection

CVE-2025-47856

High · published October 14, 2025

CVSS v3.1
7.2
EPSS
1%
Percentile
70.7
In the wild
Unconfirmed
What it is

Two improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerabilities [CWE-78] in Fortinet FortiVoice version 7.2.0, 7.0.0 through 7.0.6 and before 6.4.10 allows a privileged attacker to execute arbitrary code or commands via crafted HTTP/HTTPS or CLI requests.

The record
Technical detail
CVSS v3.1
7.2 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.01324 · 70.7th percentile
Weakness
CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2025-10-14T18:15Z
Affected products (3)
ProductVersionsFixed in
fortinet/fortivoice≥ 6.4.0, < 6.4.116.4.11
fortinet/fortivoice≥ 7.0.0, < 7.0.77.0.7
fortinet/fortivoiceall versions—
References (1)
https://fortiguard.fortinet.com/psirt/FG-IR-25-250 · [email protected]
EPSS history
Timeline
  • 14 OCT 13:42Z
    Two improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerabilities [CWE-78] in Fortinet FortiVoice version 7.2.0…
    cvelistv5