Introduction
An attacker with privileged access to FortiVoice can execute arbitrary operating system commands, which can lead to full compromise of enterprise communications infrastructure. The flaw, tracked as CVE-2025-47856, affects a range of Fortinet FortiVoice versions and comes from improper handling of command input.
About Fortinet and FortiVoice: Fortinet is a global cybersecurity vendor whose products include firewalls, endpoint security, and unified communications. FortiVoice is Fortinet's enterprise unified communications platform, and many organizations use it for voice, conferencing, and messaging. Because FortiVoice carries business communications, a vulnerability in it is a direct risk to operational security.
Technical Information
CVE-2025-47856 is an OS command injection vulnerability (CWE-78) in Fortinet FortiVoice. The flaw exists in two separate locations in the FortiVoice codebase. A privileged attacker, meaning one who has already authenticated with elevated access, can send crafted HTTP or HTTPS requests to the web management interface or issue specially constructed CLI commands. Either path can inject special shell elements and execute arbitrary code or commands with the privileges of the FortiVoice application process.
The root cause is improper neutralization of special elements in OS command construction. FortiVoice does not sufficiently sanitize user-supplied input before passing it to the underlying operating system, so an attacker can inject shell metacharacters or additional commands, and the payload runs with the application's privileges. Both the web management interface and the CLI are exposed, which gives an attacker two routes to exploitation. As of this writing, no public code snippets or proof-of-concept exploit are available for this vulnerability.
Affected Systems and Versions
CVE-2025-47856 affects the following FortiVoice versions:
- 7.2.0
- 7.0.0 through 7.0.6
- All versions before 6.4.10
Patched versions are:
- 7.2.1 and above (for 7.2.0)
- 7.0.7 and above (for 7.0.0 through 7.0.6)
- 6.4.11 and above (for versions before 6.4.10)
Vendor Security History
Fortinet has had multiple high-severity vulnerabilities across its product lines, including command injection and buffer overflow flaws. In 2025 alone, several critical vulnerabilities have been disclosed, and some have been exploited in the wild. Fortinet runs a dedicated PSIRT and generally issues advisories and patches promptly. Command injection flaws keep recurring, though, and CVE-2025-47856 is another one. That pattern points to ongoing problems with secure coding and input validation in Fortinet's development lifecycle.
