FortiWeb at Risk: Unauthenticated Attackers Gaining Full WAF Control via Admin Creation
A critical authentication bypass vulnerability in Fortinet’s FortiWeb web application firewalls (WAF), identified as CVE-2025-64446 with a CVSS score of 9.8, is being actively and indiscriminately exploited in the wild. The flaw allows unauthenticated attackers to execute administrative commands and...
A critical authentication bypass vulnerability in Fortinet’s FortiWeb web application firewalls (WAF), identified as CVE-2025-64446 with a CVSS score of 9.8, is being actively and indiscriminately exploited in the wild. The flaw allows unauthenticated attackers to execute administrative commands and gain complete control of affected devices. Fortinet has released patches to address the issue, but exploitation was observed in the wild for over a month before a CVE was assigned, giving threat actors a significant head start.
Root Cause
The vulnerability is a path traversal issue within the FortiWeb appliance. It stems from a combination of two flaws: a path traversal bug that allows access to the fwbcgi executable and an authentication bypass exploited by manipulating the CGIINFO HTTP header to impersonate an existing administrator. By sending a specially crafted HTTP POST request to a vulnerable endpoint, an attacker can instruct the fwbcgi binary to grant them administrative privileges, as the application fails to properly validate user-supplied input used for file paths.
Proof of Concept (PoC)
Security researchers not only reproduced the vulnerability but also published a detailed analysis and a proof-of-concept (PoC) script, demonstrating the ease of exploitation. The exploit works by sending a carefully crafted HTTP POST request to a specific, non-standard API endpoint: /api/v2.0/cmdb/system/admin%3f/../../../../../cgi-bin/fwbcgi. The path traversal component (/../../../../../) allows the request to break out of the intended directory and access the sensitive fwbcgi CGI binary. The authentication bypass is achieved by including a custom HTTP header named CGIINFO. This header contains a Base64-encoded JSON payload that tells the application to process the request as if it were initiated by a legitimate, authenticated administrator, typically the default “admin” account. When run against a target, it generates a random username and password, crafts the malicious POST request with the forged CGIINFO header, and sends it to the vulnerable endpoint, resulting in the creation of a new administrator account on the device. In-the-wild attacks have been observed creating admin accounts with usernames such as Testpoint, trader1, and test1234point as a persistence mechanism.
Tactics, Techniques, and Procedures (TTPs)
The exploitation of this vulnerability aligns with several tactics and techniques:
| Tactic ID | Tactic Name | Technique ID | Technique Name | Description |
| TA0001 | Initial Access | T1190 | Exploit Public-Facing Application | The vulnerability exists in an internet-facing security appliance, providing attackers with a direct entry point into the network. |
| TA0004 | Privilege Escalation | T1068 | Exploitation for Privilege Escalation | The exploit itself elevates the unauthenticated attacker’s privileges to the highest level (administrator) on the compromised device. |
| TA0003 | Persistence | T1078 | Valid Accounts | By creating new administrator accounts, attackers ensure they retain access to the system even if the original vulnerability is discovered and patched. |
| TA0005 | Defense Evasion | T1556 | Modify Authentication Process | The core of the exploit involves bypassing the WAF’s standard authentication procedures by forging header information to impersonate a trusted user. |
Impact and Exploit Potential
The successful exploitation of this vulnerability has critical consequences, allowing an unauthenticated attacker to completely compromise an affected device. This grants them the ability to bypass all authentication mechanisms and execute arbitrary commands with the highest administrative privileges. Attackers have been observed creating new administrator accounts to establish a persistent foothold, gaining unauthorized access to sensitive data and the broader network. Furthermore, a compromised firewall can be reconfigured to alter or disable security policies, effectively neutralizing the WAF and leaving web applications exposed. The compromised device can also be used as a pivot point for launching further attacks and moving laterally within the internal network. Recognizing the severity, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2025-64446 to its Known Exploited Vulnerabilities (KEV) catalog, compelling federal agencies to apply patches swiftly.
Affected Products
The vulnerability impacts multiple versions of FortiWeb. The following versions are confirmed to be affected:
- FortiWeb 8.0.0 through 8.0.1
- FortiWeb 7.6.0 through 7.6.4
- FortiWeb 7.4.0 through 7.4.9
- FortiWeb 7.2.0 through 7.2.11
- FortiWeb 7.0.0 through 7.0.11
Mitigation and Recommendations
Fortinet has released patches and urges customers to upgrade to the latest versions immediately:
- FortiWeb 8.0.2 or above
- FortiWeb 7.6.5 or above
- FortiWeb 7.4.10 or above
- FortiWeb 7.2.12 or above
- FortiWeb 7.0.12 or above
Given the active exploitation, organizations should also:
- Investigate for Compromise: Thoroughly examine FortiWeb systems for signs of unauthorized activity, including the creation of new or unexpected administrator accounts.
- Monitor Network Traffic: Check logs for suspicious HTTP POST requests to the vulnerable endpoint.
- Restrict Access: As a temporary workaround until patching is complete, disable HTTP/HTTPS access to internet-facing interfaces. However, upgrading remains the only complete solution.
- Implement Network Segmentation: Limit the potential impact of a compromise by segmenting the network and implementing strong access controls.
Instantly Fix Risks with Saner Patch Management
Saner patch management is a continuous, automated, and integrated software that instantly fixes risks exploited in the wild. The software supports major operating systems like Windows, Linux, and macOS, as well as 550+ third-party applications.
It also allows you to set up a safe testing area to test patches before deploying them in a primary production environment. Saner patch management additionally supports a patch rollback feature in case of patch failure or a system malfunction.
Experience the fastest and most accurate patching software here.
