CVE-2025-52970CWE-233

A improper handling of parameters in Fortinet FortiWeb versions 7.6.3 and below, versions 7.4.7 and below, versions 7.2.10 and below, and 7.0.10 and below may…

High · published August 12, 2025

CVSS v3.1
7.7
EPSS
10%
Percentile
95.6
In the wild
Unconfirmed
What it is

A improper handling of parameters in Fortinet FortiWeb versions 7.6.3 and below, versions 7.4.7 and below, versions 7.2.10 and below, and 7.0.10 and below may allow an unauthenticated remote attacker with non-public information pertaining to the device and targeted user to gain admin privileges on the device via a specially crafted request.

The record
Technical detail
CVSS v3.1
7.7 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:C
CVSS v4.0
Not supplied
EPSS
0.10084 · 95.6th percentile
Weakness
CWE-233 · Improper Handling of Parameters
Published
2025-08-12T18:59Z
EPSS history
Timeline
  • 12 AUG 18:59Z
    A improper handling of parameters in Fortinet FortiWeb versions 7.6.3 and below, versions 7.4.7 and below, versions 7.2.10 and below, and 7.0.10 and below may…
    cvelistv5