{
  "document": {
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE"
      }
    },
    "lang": "nl",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this page to enhance access to its information and security advisories. The use of this security advisory is subject to the following terms and conditions:\n\n    NCSC-NL makes every reasonable effort to ensure that the content of this page is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or continuous keeping up-to-date. The information contained in this security advisory is intended solely for the purpose of providing general information to professional users. No rights can be derived from the information provided therein.\n\n    NCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of this security advisory. This includes damage resulting from the inaccuracy of incompleteness of the information contained in the advisory.\n    This security advisory is subject to Dutch law. All disputes related to or arising from the use of this advisory will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings."
      },
      {
        "category": "description",
        "text": "Fortinet heeft een kwetsbaarheid verholpen in FortiWeb.",
        "title": "Feiten"
      },
      {
        "category": "description",
        "text": "Fortinet heeft een kwetsbaarheid verholpen in FortiWeb. De kwetsbaarheid met het kenmerk CVE-2025-64446 betreft een relative path traversal-kwetsbaarheid en stelt een niet-geauthenticeerde aanvaller op afstand in staat om administratieve commando\u2019s uit te voeren via speciaal vervaardigde HTTP-verzoeken.\n\nHet NCSC heeft informatie ontvangen dat de kwetsbaarheid al enige tijd actief wordt misbruikt. Tevens hebben onderzoekers Proof-of-Concept-code (PoC) gepubliceerd waarmee de kwetsbaarheid kan worden aangetoond. Het is daarom de verwachting dat het aantal pogingen tot misbruik verder zal toenemen.",
        "title": "Interpretaties"
      },
      {
        "category": "description",
        "text": "Fortinet heeft updates uitgebracht om de kwetsbaarheid te verhelpen. Zie de bijgevoegde referenties voor meer informatie.\n\nAls het installeren van een update niet direct mogelijk is, adviseert Fortinet om HTTP en HTTPS uit te schakelen op internetgerichte interfaces. Fortinet raadt aan deze maatregel in stand te houden totdat de update kan worden uitgevoerd.\n\nWanneer de beheerinterface conform best practices uitsluitend intern benaderbaar is, wordt het risico aanzienlijk verminderd.\n\nControleer de FortiWeb-omgeving op indicatoren die door beveiligingsbedrijven zijn gedeeld. De kwetsbaarheid is namelijk al misbruikt voordat Fortinet de beveiligingsupdates uitbracht. Met name organisaties waarvan de beheerinterface via het internet toegankelijk is, lopen een verhoogd risico te zijn gecompromitteerd.\n\nControleer de FortiWeb-omgeving op aanwezigheid van de volgende indicatoren van beveiligingsbedrijf Qualys. Aanwezigheid kan duiden op misbruik van de kwetsbaarheid.\n\n- Binnenkomende POST-verzoeken naar */api/v2.0/cmd/system/admin%3F/../../../../../cgi-bin/fwbcgi* of soortgelijke path-traversalpatronen afkomstig van niet-geautoriseerde IP-adressen.\n- Verzoeken met base64-encoded CGINFO-headers.\n- Onbekende beheerdersaccounts die sinds begin oktober 2025 zijn aangemaakt.\n- Nieuwe lokale gebruikersaccounts met het toegangsprofiel prof_admin.\n- Accounts met trust host-ranges ingesteld op *0.0.0.0/0* of *::/0*.",
        "title": "Oplossingen"
      },
      {
        "category": "general",
        "text": "medium",
        "title": "Kans"
      },
      {
        "category": "general",
        "text": "high",
        "title": "Schade"
      },
      {
        "category": "general",
        "text": "Relative Path Traversal",
        "title": "CWE-23"
      }
    ],
    "publisher": {
      "category": "coordinator",
      "contact_details": "cert@ncsc.nl",
      "name": "Nationaal Cyber Security Centrum",
      "namespace": "https://www.ncsc.nl/"
    },
    "references": [
      {
        "category": "external",
        "summary": "Reference",
        "url": "https://blog.qualys.com/vulnerabilities-threat-research/2025/11/14/unauthenticated-authentication-bypass-in-fortinet-fortiweb-cve-2025-64446-exploited-in-the-wild"
      },
      {
        "category": "external",
        "summary": "Reference",
        "url": "https://fortiguard.fortinet.com/psirt/FG-IR-25-910"
      },
      {
        "category": "external",
        "summary": "Reference",
        "url": "https://github.com/watchtowrlabs/watchTowr-vs-Fortiweb-AuthBypass"
      },
      {
        "category": "external",
        "summary": "Reference",
        "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-64446"
      },
      {
        "category": "external",
        "summary": "Reference",
        "url": "https://www.rapid7.com/blog/post/etr-critical-vulnerability-in-fortinet-fortiweb-exploited-in-the-wild"
      }
    ],
    "title": "Kwetsbaarheid verholpen in Fortinet FortiWeb",
    "tracking": {
      "current_release_date": "2025-11-15T14:57:33.774388Z",
      "generator": {
        "date": "2025-08-04T16:30:00Z",
        "engine": {
          "name": "V.A.",
          "version": "1.3"
        }
      },
      "id": "NCSC-2025-0366",
      "initial_release_date": "2025-11-15T14:57:33.774388Z",
      "revision_history": [
        {
          "date": "2025-11-15T14:57:33.774388Z",
          "number": "1.0.0",
          "summary": "Initiele versie"
        }
      ],
      "status": "final",
      "version": "1.0.0"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:unknown/*",
                "product": {
                  "name": "vers:unknown/*",
                  "product_id": "CSAFPID-1"
                }
              }
            ],
            "category": "product_name",
            "name": "FortiWeb"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:unknown/*",
                "product": {
                  "name": "vers:unknown/*",
                  "product_id": "CSAFPID-2"
                }
              }
            ],
            "category": "product_name",
            "name": "Fortiweb"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:unknown/*",
                "product": {
                  "name": "vers:unknown/*",
                  "product_id": "CSAFPID-3"
                }
              }
            ],
            "category": "product_name",
            "name": "Fortiweb (Application)"
          }
        ],
        "category": "vendor",
        "name": "Fortinet"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2025-64446",
      "cwe": {
        "id": "CWE-23",
        "name": "Relative Path Traversal"
      },
      "notes": [
        {
          "category": "other",
          "text": "Relative Path Traversal",
          "title": "CWE-23"
        },
        {
          "category": "description",
          "text": "Fortinet FortiWeb has a relative path traversal vulnerability that allows unauthenticated attackers to execute administrative commands via specially crafted HTTP or HTTPS requests.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2",
          "CSAFPID-3"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2025-64446 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-64446.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2",
            "CSAFPID-3"
          ]
        }
      ],
      "title": "CVE-2025-64446"
    }
  ]
}