CVE-2025-47856
HighCVSS 7.2Exploitation Probability (EPSS)
Elevated risk70th percentile - higher than 70% of all known CVEs
Summary
Fortinet FortiVoice versions 7.2.0, 7.0.0 through 7.0.6, and before 6.4.10 contain two OS command injection vulnerabilities (CWE-78). A privileged attacker can execute arbitrary code or commands via crafted HTTP/HTTPS or CLI requests.
Risk Assessment
The risk is the potential for a privileged user to fully compromise the FortiVoice system, leading to loss of confidentiality, integrity, and availability of services.
Recommendation
Immediately update FortiVoice to a patched version and restrict access to management interfaces.
Other vulnerabilities in FortiVoice
See all- CVE-2025-64156High
An improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Fortinet FortiVoice 7.2.0 through 7.2.2, FortiVoice 7.0.0 through 7.0.7, FortiVoice 6.4 all versions, FortiVoice 6.0 all versions may allow an authenticated privileged attacker to execute unauthorized code or commands via crafted requests.
- CVE-2025-60024High
Multiple Improper Limitations of a Pathname to a Restricted Directory ('Path Traversal') vulnerabilities [CWE-22] in Fortinet FortiVoice 7.2.0 through 7.2.2, FortiVoice 7.0.0 through 7.0.7 may allow a privileged authenticated attacker to write arbitrary files via specifically crafted HTTP or HTTPS commands.
Original NVD description (English source)
Two improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerabilities [CWE-78] in Fortinet FortiVoice version 7.2.0, 7.0.0 through 7.0.6 and before 6.4.10 allows a privileged attacker to execute arbitrary code or commands via crafted HTTP/HTTPS or CLI requests.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS