🚨 In this week’s Threat Alert Newsletter: exploitation of CVE-2025-25257 in Fortinet’s FortiWeb Fabric Connector.

We break down how the exploit works, what CrowdSec sees on the network, and steps to stay protected.

Read more 👇

🧵1/6

#CVE202525257 #Fortinet #FortiWeb #CyberSecurity #Infosec #ThreatIntel #CrowdSec

Critical Vulnerability Exposes Fortinet FortiWeb to Full Takeover (CVE-2025-25257) https://hackread.com/critical-vulnerability-fortinet-fortiweb-cve-2025-25257/

FortiWeb-Admins aufgepasst! 🚨 Für die kritische #Sicherheitslücke (CVE-2025-25257, CVSS 9.6) steht jetzt ein Exploit bereit – Angreifer können ohne Login SQL-Injection & Codeausführung erreichen. Jetzt dringend patchen! 🔒 Mehr Infos: https://www.heise.de/news/Exploit-verfuegbar-FortiWeb-Sicherheitsluecke-jetzt-patchen-10485654.html #Cybersecurity #Fortinet #PatchNow
#newz

Kurzlink: https://heise.de/-10485654

Patch immediately: CVE-2025-25257 PoC enables remote code execution on Fortinet FortiWeb https://securityaffairs.com/179874/security/patch-immediately-cve-2025-25257-poc-enables-remote-code-execution-on-fortinet-fortiweb.html

Fortinet Releases Patch For Critical SQL Injection Flaw In FortiWeb (CVE-2025-25257) - https://mwyr.es/ETksrXpD #thn #infosec

⚠️ Key findings:
🔹 A new SQL injection vulnerability in a FortiWeb component allows attackers to execute arbitrary code on the affected machine.
🔹 CrowdSec has been tracking exploitation since the 11th of July 2025.
🔹 Data from the CrowdSec network indicates that attacker interest in the vulnerability remains very limited.

🧵2/6

#CVE202525257 #Fortinet #FortiWeb #CyberSecurity #Infosec #ThreatIntel #CrowdSec

🛠️ About the exploit:
🔹 The Fortinet FortiWeb Fabric Connector is an integration component designed to enhance application security by linking FortiWeb web application firewalls (WAFs) with other elements of the Fortinet Security Stack. It enables policy enforcement and automated threat response by leveraging intelligence gathered from FortiGate firewalls, FortiSandbox, FortiAnalyzer, and other “Fabric-enabled” devices. It is in some sense a glue product that holds an array of different Fortinet products together.
🔹 The vulnerability allows unauthenticated attackers to execute arbitrary SQL statements against the MySQL database connected to Fabric Connector. As this database runs as root per default, this attack can be chained to run arbitrary Python code on the affected machine, allowing attackers to further compromise the system. The vulnerability affects various FortiWeb versions from 7.0 to 7.6. As a workaround, the vendor recommends disabling the administrative interface to external visitors.

🧵3/6

#CVE202525257 #Fortinet #FortiWeb #CyberSecurity #Infosec #ThreatIntel #CrowdSec

📈 Trend analysis:
🔹 CrowdSec detected the first in-the-wild exploitation of this vulnerability on July 11th, shortly after we rolled out detection rules. Using our wayback tools, we were able to establish that there were no exploitation attempts before July 11th, confirming once again that public exploits are a key driver of vulnerability weaponization.
🔹 For CVE-2025-25257, CrowdSec has observed about 40 distinct IPs producing about 500 attack events in total. Most of these attacks occurred on Friday, July 11th, the day the exploit was publicized. The attacks on Friday were mainly due to a presumably coordinated attacker spinning up a bunch of machines on Scaleway cloud to use in a broad scanning campaign. Over the weekend, the exploit quickly lost popularity. This might be due to the fact that the exploit requires the Fabric Connector administrative interface to be publicly accessible, which is somewhat unlikely. While we cannot make predictions, CrowdSec expects exploitation signals to pick up slightly this week as vulnerability scanners start looking for vulnerable devices. However, we don’t expect the attacker volume for this vulnerability to reach that of other Fortinet-related CVEs.

🧵4/6

#CVE202525257 #Fortinet #FortiWeb #CyberSecurity #Infosec #ThreatIntel #CrowdSec

🛡️ How to protect your systems:
🔹 Patch: Patch your FortiWeb instance if it is publicly exposed; otherwise, remove outside access to the affected admin panel.
🔹 Preemptive blocking: Use Crowdsec CTI to block IPs exploiting CVE-2025-25257 👉 https://app.crowdsec.net/cti?q=cves%3A%22CVE-2025-25257%22&page=1
🔹 Stay proactive: Install the Crowdsec Web Application Firewall to stay ahead of exploit attempts, with 100+ virtual patching rules available. 👉 https://doc.crowdsec.net/docs/next/appsec/intro

🧵5/6

#CVE202525257 #Fortinet #FortiWeb #CyberSecurity #Infosec #ThreatIntel #CrowdSec

Sharing insights and taking swift action can collectively reduce the impact of these threats. This is your call to action for real-time threat intelligence and collaborative cybersecurity.

For more information, visit http://crowdsec.net

Want to stay ahead of the latest cyber threats? Get our weekly Threat Alert delivered straight to your inbox, along with critical threat updates and trending cybersecurity insights.

📩 Sign up now for exclusive access: https://contact.crowdsec.net/threat-alert

🧵6/6

#CVE202525257 #Fortinet #FortiWeb #CyberSecurity #Infosec #ThreatIntel #CrowdSec

A detailed description of CVE-2025-53020, a DoS vulnerability in the HTTP/2 implementation of Apache httpd. Fixed in 2.4.64.
#apache #httpd #http2

https://github.com/icing/blog/blob/main/hpack-bombing-apache.md

Good write-up on CVE-2025-53020 above.

https://github.com/icing/blog/blob/main/hpack-bombing-apache.md

Twas nice of KEV to catch up to us in caring about the Wing FTP RCE

https://viz.greynoise.io/tags/wing-ftp-server-loginok-html-cve-2025-47812-remote-code-execution-attempt?days=30

Critical Wing FTP Server Vulnerability (CVE-2025-47812) Actively Being Exploited In The Wild - https://mwyr.es/0nonYsR9 #thn #infosec

We have reproduced "ToolShell", the unauthenticated exploit chain for CVE-2025-49706 + CVE-2025-49704 used by @_l0gg to pop SharePoint at #Pwn2Own Berlin 2025, it's really just one request! Kudos to @mwulftange

We have reproduced "ToolShell", the unauthenticated exploit chain for CVE-2025-49706 + CVE-2025-49704 used by @_l0gg to pop SharePoint at #Pwn2Own Berlin 2025, it's really just one request! Kudos to @mwulftange

LB-LINK routers (BL-AC1900 & more, ≤20250702) face CRITICAL risk: CVE-2025-7574 allows remote, unauthenticated reboot/restore via /cgi-bin/lighttpd.cgi. Public exploit, no patch yet. Restrict access & monitor! https://radar.offseq.com/threat/cve-2025-7574-improper-authentication-in-lb-link-b-84743308 #OffSeq #RouterSecurity #CVE20257574

Emacs Ninja - CVE-2025-1244: From Emacs URL Handler to RCE

https://piefed.social/post/1040293

If you’re using #Immich, a self-hosted photo and video management solution check for an update if you’re not running on the latest version, because prior to 1.132.0, Immich is vulnerable to account hijacking through oauth2.
https://github.com/immich-app/immich/security/advisories/GHSA-3832-6r8h-9cfm
CVSSv4:7.3
CVE-2025-43856, CWE-303
#security #cybersecurity #vulnerability

This looks like an older disclosure of some vulns in Avid Nexis Agent but it includes a ../ that, at least at the time, was undocumented in gSOAP. That CVE was just published today.

https://raeph123.github.io/BlogPosts/Avid_Nexis/Advisory_Avid_Nexus_Agent_Multiple_Vulnerabilities_en.html

https://www.cve.org/CVERecord?id=CVE-2024-26293