Disclosed
CVE-2025-52970
A improper handling of parameters in Fortinet FortiWeb versions 7.6.3 and below, versions 7.4.7 and below, versions 7.2.10 and below, and 7.0.10 and below may allow an unauthenticated remote attacker with non-public information pertaining to the device and targeted user to gain admin privileges on the device via a specially crafted request.
Exploitation Probability (EPSS)
Medium Priority28.84%
The Exploit Prediction Scoring System (EPSS) uses machine learning to estimate the probability that a vulnerability will be exploited in the wild within the next 30 days.
0% (Theoretical)100% (Certainty)
7-Day Exploitation Trend
Vulnerability Timeline
4 eventsAug 12, 2025
Vulnerability Disclosed
Published to component-level vulnerability database.
Aug 15, 2025
Last Updated
Record updated with new analysis or tags.
Dec 20, 2025
EPSS Score Increased
Daily EPSS score increased by 0.187 on 2025-08-14
Jan 13, 2026
EPSS Score Decreased
Daily EPSS score decreased by 0.127 on 2025-08-14
Threat Actor Attribution
PREMIUM INTELAssociated Groups:Lazarus Group, APT28
Ransomware Campaigns:LockBit 3.0, BlackCat
IoCs (Indicators):14 IPs, 3 Hashes
Remediation & Mitigation
SOLUTIONOfficial patches and mitigation steps are available for this vulnerability.
# Update Command
apt-get update && apt-get upgrade -y specific-package
# Verify installation
dpkg -l | grep package-name
apt-get update && apt-get upgrade -y specific-package
# Verify installation
dpkg -l | grep package-name
Affected Products
1 Total
fortinet/fortiwebAll Versions
Am I Vulnerable?
Check your domain or package.json for CVE-2025-52970 exposure.
Vulnerability Details
CVSS Base Score
8.1/ 10
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Published Date
Aug 12, 2025
Last Modified
Aug 15, 2025
Need Manual Validation?
Automated scanners flag false positives. Get a manual pentest validation for this CVE.