CVE-2025-64156
HighCVSS 7.2Exploitation Probability (EPSS)
Low risk23th percentile - higher than 23% of all known CVEs
Summary
An improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Fortinet FortiVoice 7.2.0 through 7.2.2, FortiVoice 7.0.0 through 7.0.7, FortiVoice 6.4 all versions, FortiVoice 6.0 all versions may allow an authenticated privileged attacker to execute unauthorized code or commands via crafted requests.
Risk Assessment
This could lead to execution of unauthorized code or commands, potentially resulting in system compromise or data leakage.
Recommendation
Update FortiVoice to the latest version containing security patches provided by Fortinet.
Other vulnerabilities in FortiVoice
See all- CVE-2025-60024High
Multiple Improper Limitations of a Pathname to a Restricted Directory ('Path Traversal') vulnerabilities [CWE-22] in Fortinet FortiVoice 7.2.0 through 7.2.2, FortiVoice 7.0.0 through 7.0.7 may allow a privileged authenticated attacker to write arbitrary files via specifically crafted HTTP or HTTPS commands.
- CVE-2025-47856High
Fortinet FortiVoice versions 7.2.0, 7.0.0 through 7.0.6, and before 6.4.10 contain two OS command injection vulnerabilities (CWE-78). A privileged attacker can execute arbitrary code or commands via crafted HTTP/HTTPS or CLI requests.
Original NVD description (English source)
An improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiVoice 7.2.0 through 7.2.2, FortiVoice 7.0.0 through 7.0.7, FortiVoice 6.4 all versions, FortiVoice 6.0 all versions may allow an authenticated privileged attacker to execute unauthorized code or commands via crafted requests
Vulnerability data from NVD (NIST) · CISA KEV · EPSS