{"basis":"claimed","id":"CVE-2025-52970","name":"Fortinet FortiWeb","vendorProject":"Fortinet","product":"FortiWeb","publishedAt":"2025-08-12","cvss":{"score":7.7,"severity":"HIGH","version":"3.1"},"exploited":null,"epss":{"score":0.10129,"percentile":0.95649,"date":"2026-11-02"},"coverage":{"cloudflare":{"status":"off","firstOn":"2025-09-01","daysToRule":20},"aws":{"status":"none","firstOn":null,"daysToRule":null},"azure":{"status":"none","firstOn":null,"daysToRule":null},"google":{"status":"none","firstOn":null,"daysToRule":null},"fastly":{"status":"no_history","firstOn":null,"daysToRule":null},"f5":{"status":"rule","firstOn":"2025-12-03","daysToRule":113},"akamai":{"status":"no_source","firstOn":null,"daysToRule":null},"crs":{"status":"none","firstOn":null,"daysToRule":null}},"title":null,"description":"A improper handling of parameters in Fortinet FortiWeb versions 7.6.3 and below, versions 7.4.7 and below, versions 7.2.10 and below, and 7.0.10 and below may allow an unauthenticated remote attacker with non-public information pertaining to the device and targeted user to gain admin privileges on the device via a specially crafted request.","cwes":["CWE-233"],"vendors":[{"vendor":"cloudflare","status":"off","basis":"claimed","firstOn":"2025-09-01","firstIsNew":true,"daysToRule":20,"daysAtMost":null,"freePlan":false,"claims":[{"id":"14bfedb1e64e45376c72bc49c4ea5a1a737f8f12cb996a8c05b2910f0f84c3f5","cve_id":"CVE-2025-52970","vendor":"cloudflare","product":"Cloudflare Managed Ruleset","rule_id":"636b145a49a84946b990d4fac49b7cf8","rule_name":"Fortinet FortiWeb - Auth Bypass - CVE:CVE-2025-52970","change":"new","default_action":"Disabled","published_on":"2025-09-01","source_url":"https://developers.cloudflare.com/changelog/post/2025-09-01-waf-release/","source_title":"WAF Release - 2025-09-01","excerpt":"Fortinet FortiWeb - Auth Bypass - CVE:CVE-2025-52970. Previous action: Log. New action: Disabled. This is a New Detection","first_seen_at":"2026-11-02T21:00:16.135Z"}]},{"vendor":"aws","status":"none","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"azure","status":"none","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"google","status":"none","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"fastly","status":"no_history","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"f5","status":"rule","basis":"claimed","firstOn":"2025-12-03","firstIsNew":true,"daysToRule":113,"daysAtMost":null,"freePlan":false,"claims":[{"id":"00b7453be9bf8725887c9fd0e78f630d5395670d2de647582f77bd5c22402e5d","cve_id":"CVE-2025-52970","vendor":"f5","product":"Attack signatures","rule_id":"200013134","rule_name":"FortiWeb Authentication Bypass","change":"new","default_action":null,"published_on":"2025-12-03","source_url":"https://docs.cloud.f5.com/docs-v2/platform/changelogs/security-details-changelog","source_title":"F5 Distributed Cloud attack signatures changelog","excerpt":"Added: signature 200013134 \"FortiWeb Authentication Bypass\" (Authentication/Authorization Attacks, risk High), systems: Other Web Server. References: CVE-2025-52970.","first_seen_at":"2026-11-02T21:00:25.304Z"}]},{"vendor":"akamai","status":"no_source","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"crs","status":"none","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]}],"updatedAt":"2026-11-02T21:16:34.613Z","cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:C","ssvc":{"exploitation":"poc","automatable":"no","technicalImpact":"total"},"measured":[{"engineId":"owasp-crs","engineName":"OWASP Core Rule Set","engineVersion":"4.25.0","runtime":"Coraza v3.8.1","config":"paranoia level 1, anomaly threshold 5, default CRS settings","ranAt":"2026-11-02T13:02:57.000Z","verdict":"passed","templateId":"CVE-2025-52970","templatePath":"http/cves/2025/CVE-2025-52970.yaml","requests":25,"blockedRequests":0,"rules":[],"note":"","requestDetail":[{"method":"GET","path":"/login","status":200,"blocked":false,"rules":[]},{"method":"GET","path":"/api/fabric/device/status","status":200,"blocked":false,"rules":[]},{"method":"GET","path":"/api/fabric/device/status","status":200,"blocked":false,"rules":[]},{"method":"GET","path":"/api/fabric/device/status","status":200,"blocked":false,"rules":[]},{"method":"GET","path":"/api/fabric/device/status","status":200,"blocked":false,"rules":[]},{"method":"GET","path":"/api/fabric/device/status","status":200,"blocked":false,"rules":[]},{"method":"GET","path":"/api/fabric/device/status","status":200,"blocked":false,"rules":[]},{"method":"GET","path":"/api/fabric/device/status","status":200,"blocked":false,"rules":[]},{"method":"GET","path":"/api/fabric/device/status","status":200,"blocked":false,"rules":[]},{"method":"GET","path":"/api/fabric/device/status","status":200,"blocked":false,"rules":[]},{"method":"GET","path":"/api/fabric/device/status","status":200,"blocked":false,"rules":[]},{"method":"GET","path":"/api/fabric/device/status","status":200,"blocked":false,"rules":[]}]},{"engineId":"owasp-crs","engineName":"OWASP Core Rule Set","engineVersion":"4.25.0","runtime":"Coraza v3.8.1","config":"paranoia level 2, anomaly threshold 5, default CRS settings","ranAt":"2026-11-02T13:03:28.000Z","verdict":"partial","templateId":"CVE-2025-52970","templatePath":"http/cves/2025/CVE-2025-52970.yaml","requests":25,"blockedRequests":7,"rules":["942480"],"note":"","requestDetail":[{"method":"GET","path":"/login","status":200,"blocked":false,"rules":[]},{"method":"GET","path":"/api/fabric/device/status","status":403,"blocked":true,"rules":["942480"]},{"method":"GET","path":"/api/fabric/device/status","status":200,"blocked":false,"rules":[]},{"method":"GET","path":"/api/fabric/device/status","status":403,"blocked":true,"rules":["942480"]},{"method":"GET","path":"/api/fabric/device/status","status":200,"blocked":false,"rules":[]},{"method":"GET","path":"/api/fabric/device/status","status":200,"blocked":false,"rules":[]},{"method":"GET","path":"/api/fabric/device/status","status":200,"blocked":false,"rules":[]},{"method":"GET","path":"/api/fabric/device/status","status":200,"blocked":false,"rules":[]},{"method":"GET","path":"/api/fabric/device/status","status":200,"blocked":false,"rules":[]},{"method":"GET","path":"/api/fabric/device/status","status":200,"blocked":false,"rules":[]},{"method":"GET","path":"/api/fabric/device/status","status":403,"blocked":true,"rules":["942480"]},{"method":"GET","path":"/api/fabric/device/status","status":403,"blocked":true,"rules":["942480"]}]}],"social":{"total":0,"first_seen":null,"daily":[{"day":"2026-10-21","posts":0},{"day":"2026-10-22","posts":0},{"day":"2026-10-23","posts":0},{"day":"2026-10-24","posts":0},{"day":"2026-10-25","posts":0},{"day":"2026-10-26","posts":0},{"day":"2026-10-27","posts":0},{"day":"2026-10-28","posts":0},{"day":"2026-10-29","posts":0},{"day":"2026-10-30","posts":0},{"day":"2026-10-31","posts":0},{"day":"2026-11-01","posts":0},{"day":"2026-11-02","posts":0},{"day":"2026-11-03","posts":0}],"top_posts":[],"exploit_repositories":[]}}