Hunter4Hunter
Why This Case Matters
Fortinet describes CVE-2025-64446 as a critical relative-path-traversal issue in the FortiWeb management GUI. A crafted unauthenticated HTTP or HTTPS request may allow administrative commands to be executed. Fortinet has stated that it observed exploitation in the wild, and the vulnerability appears in CISA’s Known Exploited Vulnerabilities catalog.
This Case does not include an exploit request. Appliance research must remain inside an isolated, explicitly authorized environment.
Affected and Fixed Releases
Fortinet’s advisory lists these minimum fixed releases:
| Branch | Affected releases | Upgrade target |
|---|---|---|
| 8.0 | 8.0.0–8.0.1 | 8.0.2 or later |
| 7.6 | 7.6.0–7.6.4 | 7.6.5 or later |
| 7.4 | 7.4.0–7.4.9 | 7.4.10 or later |
| 7.2 | 7.2.0–7.2.11 | 7.2.12 or later |
| 7.0 | 7.0.0–7.0.11 | 7.0.12 or later |
FortiWeb 6.4 is listed as not affected.
Required Remediation
Upgrade to the fixed release for the installed branch. Until the upgrade is complete, Fortinet recommends disabling HTTP and HTTPS management on internet-facing interfaces. Restricting management access to a dedicated internal administration network reduces exposure but should not replace patching.
After upgrading:
- Review the configuration for unexpected changes.
- Identify unauthorized or newly added administrator accounts.
- Rotate credentials and revoke active sessions if compromise is suspected.
- Preserve management and authentication logs before making extensive changes.
Primary sources:
Defensive Research Plan
An authorized lab should determine:
- Which management log events capture rejected and successful crafted requests.
- Whether unauthorized administrative commands are distinguishable from normal GUI activity.
- Which audit records remain after an attacker creates or modifies an administrator account.
- Whether the workaround fully removes HTTP and HTTPS management exposure from untrusted interfaces.
- Whether the patched appliance rejects the same test without disrupting legitimate administration.
Current Evidence Gap
The official remediation is documented, but no appliance reproduction, detection rule, or independent post-patch validation has been completed.