CVE-2025-60024
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk37th percentile - higher than 37% of all known CVEs
Summary
Multiple Improper Limitations of a Pathname to a Restricted Directory ('Path Traversal') vulnerabilities [CWE-22] in Fortinet FortiVoice 7.2.0 through 7.2.2, FortiVoice 7.0.0 through 7.0.7 may allow a privileged authenticated attacker to write arbitrary files via specifically crafted HTTP or HTTPS commands.
Risk Assessment
An attacker can write arbitrary files on the system, potentially leading to code execution or configuration modification. The risk includes system compromise.
Recommendation
Update FortiVoice to the latest version. Restrict access to the HTTP/HTTPS interface to trusted networks.
Other vulnerabilities in FortiVoice
See all- CVE-2025-64156High
An improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Fortinet FortiVoice 7.2.0 through 7.2.2, FortiVoice 7.0.0 through 7.0.7, FortiVoice 6.4 all versions, FortiVoice 6.0 all versions may allow an authenticated privileged attacker to execute unauthorized code or commands via crafted requests.
- CVE-2025-47856High
Fortinet FortiVoice versions 7.2.0, 7.0.0 through 7.0.6, and before 6.4.10 contain two OS command injection vulnerabilities (CWE-78). A privileged attacker can execute arbitrary code or commands via crafted HTTP/HTTPS or CLI requests.
Original NVD description (English source)
Multiple Improper Limitations of a Pathname to a Restricted Directory ('Path Traversal') vulnerabilities [CWE-22] vulnerability in Fortinet FortiVoice 7.2.0 through 7.2.2, FortiVoice 7.0.0 through 7.0.7 may allow a privileged authenticated attacker to write arbitrary files via specifically HTTP or HTTPS commands
Vulnerability data from NVD (NIST) · CISA KEV · EPSS