CVE-2025-52970: high-severity vulnerability in Fortinet FortiWeb
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
83Vexday Risk Score
Patch now. It exploitation observed by VulnCheck and has a working public exploit.
ssvc Actcvss 7.7epss 10%
from disclosure to weapon26 days
Published on NVDAug 12
1st PoC+26d
VulnCheck+23d
A improper handling of parameters vulnerability in Fortinet FortiWeb 7.6.0 through 7.6.3, FortiWeb 7.4.0 through 7.4.7, FortiWeb 7.2.0 through 7.2.10, FortiWeb 7.0.0 through 7.0.10 may allow an unauthenticated remote attacker with non-public information pertaining to the device and targeted user to gain admin privileges on the device via a specially crafted request.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:C
Affected products
Fortinet · FortiWebpublic PoCs found — 2
vulncheckvulncheck.com/xdb/6d2494a00260unverifiedvulncheckvulncheck.com/xdb/ac25fe9ad70cunverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Fortinet FortiWeb
In the same product, most dangerous first.