CVE-2025-64156

An improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiVoice 7.2.0 through 7.2.2, FortiVoice 7.0.0 through 7.0.7, FortiVoice 6.4 all versions, FortiVoice 6.0 all versions may allow an authenticated privileged attacker to execute unauthorized code or commands via crafted requests

CVSS v3 7.2 HIGH

7.2^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.2 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://fortiguard.fortinet.com/psirt/FG-IR-25-362	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:fortinet:fortivoice::::::::
	cpe:2.3:a:fortinet:fortivoice::::::::
	cpe:2.3:a:fortinet:fortivoice::::::::
	cpe:2.3:a:fortinet:fortivoice::::::::

History

25 Sep 2026, 23:10

Type	Values Removed	Values Added
Summary		(es) Una neutralización incorrecta de elementos especiales utilizados en un comando SQL ('inyección SQL') vulnerabilidad en Fortinet FortiVoice 7.2.0 hasta 7.2.1, FortiVoice 7.0.0 hasta 7.0.7, FortiVoice 6.4 todas las versiones, FortiVoice 6.0 todas las versiones puede permitir a un atacante privilegiado autenticado ejecutar código o comandos no autorizados a través de solicitudes manipuladas.

Information

Published : 2025-12-09 18:16

Updated : 2026-09-25 23:10

NVD link : CVE-2025-64156

Mitre link : CVE-2025-64156

CVE.ORG link : CVE-2025-64156

JSON object : View

Products Affected

fortinet

fortivoice

CWE

CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

{"id": "CVE-2025-64156", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-64156", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2025-12-10T04:57:31.437060Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "psirt@fortinet.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.2}]}, "affected": [{"source": "psirt@fortinet.com", "affectedData": [{"cpes": ["cpe:2.3:a:fortinet:fortivoice:7.2.1:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortivoice:7.2.0:*:*:*:*:*:*:*"], "vendor": "Fortinet", "product": "FortiVoice", "versions": [{"status": "affected", "version": "7.2.0", "versionType": "semver", "lessThanOrEqual": "7.2.1"}], "defaultStatus": "unaffected"}]}], "published": "2025-12-09T18:16:05.070", "references": [{"url": "https://fortiguard.fortinet.com/psirt/FG-IR-25-362", "tags": ["Vendor Advisory"], "source": "psirt@fortinet.com"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "psirt@fortinet.com", "description": [{"lang": "en", "value": "CWE-89"}]}], "descriptions": [{"lang": "en", "value": "An improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiVoice 7.2.0 through 7.2.2, FortiVoice 7.0.0 through 7.0.7, FortiVoice 6.4 all versions, FortiVoice 6.0 all versions may allow an authenticated privileged attacker to execute unauthorized code or commands via crafted requests"}, {"lang": "es", "value": "Una neutralizaci\u00f3n incorrecta de elementos especiales utilizados en un comando SQL ('inyecci\u00f3n SQL') vulnerabilidad en Fortinet FortiVoice 7.2.0 hasta 7.2.1, FortiVoice 7.0.0 hasta 7.0.7, FortiVoice 6.4 todas las versiones, FortiVoice 6.0 todas las versiones puede permitir a un atacante privilegiado autenticado ejecutar c\u00f3digo o comandos no autorizados a trav\u00e9s de solicitudes manipuladas."}], "lastModified": "2026-09-25T23:10:00.463", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:fortinet:fortivoice:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C0B44874-E530-40B9-92F5-03667CFB9F1C", "versionEndIncluding": "6.0.12", "versionStartIncluding": "6.0.0"}, {"criteria": "cpe:2.3:a:fortinet:fortivoice:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "939D1D33-71FB-41B6-950F-7FA3A873FBB1", "versionEndIncluding": "6.4.11", "versionStartIncluding": "6.4.0"}, {"criteria": "cpe:2.3:a:fortinet:fortivoice:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3D5BBE03-68A7-4852-BCD5-67CFB7CAD155", "versionEndIncluding": "7.0.7", "versionStartIncluding": "7.0.0"}, {"criteria": "cpe:2.3:a:fortinet:fortivoice:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6AC1D7F3-43FD-4634-ABE5-2D17D4F9B0CC", "versionEndIncluding": "7.2.1", "versionStartIncluding": "7.2.0"}], "operator": "OR"}]}], "sourceIdentifier": "psirt@fortinet.com"}