# CVE-2025-52970: Fortinet FortiWeb

- Exploited (CISA KEV): no
- Published: 2025-08-12
- CVSS: 7.7 HIGH (v3.1)
- EPSS: 10.1% (96th percentile)
- CWE: CWE-233

A improper handling of parameters in Fortinet FortiWeb versions 7.6.3 and below, versions 7.4.7 and below, versions 7.2.10 and below, and 7.0.10 and below may allow an unauthenticated remote attacker with non-public information pertaining to the device and targeted user to gain admin privileges on the device via a specially crafted request.

## Edge WAF coverage (claimed by vendors, not measured)

| Vendor | Status | First rule | Days after publication |
|---|---|---|---|
| Cloudflare | Rule off by default | 2025-09-01 | 20 |
| AWS | No public claim | — | — |
| Microsoft Azure | No public claim | — | — |
| Google Cloud | No public claim | — | — |
| Fastly | Before feed history | — | — |
| F5 | Rule published | 2025-12-03 | 113 |
| Akamai | No public source | — | — |
| OWASP CRS | No public claim | — | — |

### Cloudflare

- 2025-09-01 · new · rule 636b145a49a84946b990d4fac49b7cf8 · default Disabled
  > Fortinet FortiWeb - Auth Bypass - CVE:CVE-2025-52970. Previous action: Log. New action: Disabled. This is a New Detection
  Source: https://developers.cloudflare.com/changelog/post/2025-09-01-waf-release/

### F5

- 2025-12-03 · new · rule 200013134
  > Added: signature 200013134 "FortiWeb Authentication Bypass" (Authentication/Authorization Attacks, risk High), systems: Other Web Server. References: CVE-2025-52970.
  Source: https://docs.cloud.f5.com/docs-v2/platform/changelogs/security-details-changelog

## Our test (measured)

- OWASP Core Rule Set 4.25.0, paranoia level 1, anomaly threshold 5, default CRS settings: passed (0 of 25 requests blocked), template CVE-2025-52970, 2026-11-02
- OWASP Core Rule Set 4.25.0, paranoia level 2, anomaly threshold 5, default CRS settings: partial (7 of 25 requests blocked), template CVE-2025-52970, 2026-11-02

"No public claim" means no vendor statement names this CVE; "Before feed history" means the CVE is older than the vendor feed. In both cases generic rules may still block it.

HTML: https://cve.vigilbase.com/cve/CVE-2025-52970 · JSON: https://cve.vigilbase.com/api/v1/cves/CVE-2025-52970