FortiOS 7.6.3: Unsafe Debug CLI allows admin to exec Lua scripts
CVE-2025-67862 Published on June 9, 2026

An Internal Asset Exposed to Unsafe Debug Access Level or State vulnerability [CWE-1244] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.2, FortiOS 7.4.0 through 7.4.7, FortiOS 7.2.0 through 7.2.10, FortiOS 7.0.0 through 7.0.16, FortiOS 6.4 all versions, FortiProxy 7.6.0 through 7.6.3, FortiProxy 7.4.0 through 7.4.10, FortiProxy 7.2.0 through 7.2.14, FortiProxy 7.0 all versions may allow an authenticated admin to execute lua scripts via crafted CLI commands.

NVD

Vulnerability Analysis

CVE-2025-67862 is exploitable with local system access, and requires user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to be very high.

Attack Vector:
LOCAL
Attack Complexity:
LOW
Privileges Required:
HIGH
User Interaction:
NONE
Scope:
UNCHANGED
Confidentiality Impact:
HIGH
Integrity Impact:
HIGH
Availability Impact:
HIGH

Weakness Type

Improper Access to Sensitive Information Using Debug and Test Interfaces

The product's physical debug and test interface protection does not block untrusted agents, resulting in unauthorized access to and potentially control of sensitive assets.


Products Associated with CVE-2025-67862

stack.watch emails you whenever new vulnerabilities are published in Fortinet FortiOS or Fortinet FortiProxy. Just hit a watch button to start following.

Fortinet FortiOS
 
Fortinet FortiProxy
 

Affected Versions

Fortinet FortiOS: Fortinet FortiProxy: