CVE-2025-67862: 
FortiOS Schwachstellenanalyse und -minderung

CVE-2025-67862 is a "Restricted CLI Escape Using Lua" vulnerability (CWE-1244: Internal Asset Exposed to Unsafe Debug Access Level or State) in Fortinet FortiOS and FortiProxy. It allows an authenticated administrator to execute arbitrary Lua scripts via crafted CLI commands, effectively escaping the restricted CLI environment. Affected versions include FortiOS 6.4 (all versions), 7.0.0–7.0.16, 7.2.0–7.2.10, 7.4.0–7.4.7, and 7.6.0–7.6.2; and FortiProxy 7.0 (all versions), 7.2.0–7.2.14, 7.4.0–7.4.10, and 7.6.0–7.6.3. The vulnerability was publicly disclosed on June 9, 2026, and was reported by the UK's National Cyber Security Centre (NCSC) under responsible disclosure. It carries a CVSSv3 base score of 6.0–6.7 (Medium/High), requiring local access and high privileges (FortiGuard Advisory).

The root cause is classified as CWE-1244 (Internal Asset Exposed to Unsafe Debug Access Level or State), where debug-level Lua scripting capabilities remain accessible through the CLI in production firmware. An authenticated administrator can craft specific CLI commands that invoke the embedded Lua interpreter, bypassing the intended restrictions of the FortiOS/FortiProxy restricted shell environment. Exploitation requires local access and administrative credentials (high privilege), with no user interaction needed and low attack complexity. No public proof-of-concept code has been identified (FortiGuard Advisory).

Successful exploitation allows an authenticated admin to execute arbitrary Lua scripts on the affected system, resulting in high impact to confidentiality, integrity, and availability. An attacker with admin CLI access could read sensitive configuration files and credentials, modify system settings, corrupt data, or crash services. While the attack vector is local and requires existing administrative access, this vulnerability could be leveraged as part of a post-compromise escalation or persistence technique on network security appliances (FortiGuard Advisory).

1. Gain Administrative Access: Obtain valid administrator credentials for a FortiOS or FortiProxy device running a vulnerable version, either through credential theft, phishing, or reuse of compromised accounts.
2. Access the CLI: Connect to the device CLI via SSH or the management console using the compromised admin account.
3. Craft Malicious CLI Command: Construct a specially crafted CLI command that invokes the embedded Lua interpreter through the debug access path exposed in the restricted shell.
4. Execute Lua Script: The crafted command causes the system to execute arbitrary Lua code, bypassing the intended CLI restrictions and operating with the privileges of the FortiOS process.
5. Achieve Objective: Use the Lua execution capability to read sensitive files (e.g., configuration, credentials), modify system state, or disrupt services (FortiGuard Advisory).

• Logs: Unusual or unexpected CLI command sequences in FortiOS/FortiProxy audit logs, particularly commands referencing Lua or debug-level functions; admin login events from unexpected source IPs or at unusual times.
• Process/Behavior: Unexpected Lua interpreter invocations or script execution events within the FortiOS process space; anomalous file read/write operations initiated from the CLI session.
• Network: Outbound connections from the management interface to unknown external hosts following an admin CLI session, which may indicate data exfiltration post-exploitation.

Fortinet has released patched versions addressing this vulnerability: FortiOS 7.6.3 or above, FortiOS 7.4.8 or above, FortiOS 7.2.11 or above, FortiProxy 7.6.4 or above, FortiProxy 7.4.11 or above, and FortiProxy 7.2.15 or above. Note that FortiOS 7.0 and 6.4 branches and FortiProxy 7.0 are listed as affected with no patch version specified in the advisory, so upgrading to a supported branch is recommended. As interim mitigations, restrict CLI access to trusted administrators only, enforce strict access controls on management interfaces, and monitor for suspicious CLI command patterns. Use the Fortinet upgrade path tool at https://docs.fortinet.com/upgrade-tool to plan upgrades (FortiGuard Advisory).

The vulnerability was reported to Fortinet by the UK's National Cyber Security Centre (NCSC) under responsible disclosure, indicating coordinated handling prior to public release (FortiGuard Advisory). Heise (a German technology publication) covered the disclosure as part of a broader roundup of Fortinet security fixes released in June 2026 (Heise News). Community reaction has been relatively muted given the requirement for authenticated admin access, with no significant social media controversy or researcher commentary identified beyond standard vulnerability tracking.