{"uuid": "6afe5b79-a708-4413-9b26-48d93049c350", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-58034", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/fortinet_fortiweb_rce.rb", "content": "{\"aliases\": [], \"arch\": \"cmd\", \"author\": [\"Defused\", \"sfewer-r7\"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": true, \"default_credential\": false, \"description\": \"This exploit module exploits an authentication bypass via path traversal vulnerability in the Fortinet\\n          FortiWeb management interface to create a new local administrator user account. From there a command\\n          injection vulnerability is leveraged to achieve RCE with root privileges.\\n\\n          The auth bypass CVE-2025-64446 affects the following versions:\\n\\n          * FortiWeb 8.0.0 through 8.0.1 (Patched in 8.0.2 and above)\\n          * FortiWeb 7.6.0 through 7.6.4 (Patched in 7.6.5 and above)\\n          * FortiWeb 7.4.0 through 7.4.9 (Patched in 7.4.10 and above)\\n          * FortiWeb 7.2.0 through 7.2.11 (Patched in 7.2.12 and above)\\n          * FortiWeb 7.0.0 through 7.0.11 (Patched in 7.0.12 and above)\\n\\n          The command injection CVE-2025-58034 affects the following versions (Note the 7.6 and 7.4 branches are very\\n          slightly different when compared to the patch versions for CVE-2025-64446:\\n\\n          * FortiWeb 8.0.0 through 8.0.1 (Patched in 8.0.2 and above)\\n          * FortiWeb 7.6.0 through 7.6.5 (Patched in 7.6.6 and above) <-- slight difference\\n          * FortiWeb 7.4.0 through 7.4.10 (Patched in 7.4.11 and above) <-- slight difference\\n          * FortiWeb 7.2.0 through 7.2.11 (Patched in 7.2.12 and above)\\n          * FortiWeb 7.0.0 through 7.0.11 (Patched in 7.0.12 and above)\\n\\n          Note: Unsupported versions 6.* are also affected.\\n\\n          This exploit module has been confirmed to work against 8.0.1, 7.4.8, 6.4.3, and 6.3.9.\", \"disclosure_date\": \"2025-11-14\", \"fullname\": \"exploit/linux/http/fortinet_fortiweb_rce\", \"is_install_path\": true, \"mod_time\": \"2026-06-02 10:32:30 +0000\", \"name\": \"Fortinet FortiWeb unauthenticated RCE\", \"needs_cleanup\": null, \"notes\": {\"RelatedModules\": [\"auxiliary/admin/http/fortinet_fortiweb_create_admin\"], \"Reliability\": [\"repeatable-session\"], \"SideEffects\": [\"ioc-in-logs\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/exploits/linux/http/fortinet_fortiweb_rce.rb\", \"platform\": \"Linux,Unix\", \"post_auth\": false, \"rank\": 600, \"ref_name\": \"linux/http/fortinet_fortiweb_rce\", \"references\": [\"CVE-2025-64446\", \"EDB-52495\", \"EDB-52502\", \"CVE-2025-58034\", \"URL-https://attackerkb.com/topics/zClpINmLCh/cve-2025-58034/rapid7-analysis\", \"URL-https://x.com/defusedcyber/status/1975242250373517373\", \"URL-https://github.com/watchtowrlabs/watchTowr-vs-Fortiweb-AuthBypass\", \"URL-https://www.pwndefend.com/2025/11/13/suspected-fortinet-zero-day-exploited-in-the-wild/\", \"URL-https://www.rapid7.com/blog/post/etr-critical-vulnerability-in-fortinet-fortiweb-exploited-in-the-wild/\", \"URL-https://www.fortiguard.com/psirt/FG-IR-25-910\", \"URL-https://www.fortiguard.com/psirt/FG-IR-25-513\"], \"rport\": 443, \"session_types\": false, \"targets\": [\"FortiWeb 8.x\", \"FortiWeb 7.x and 6.x\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:48:34.385373Z"}