Introduction
Privilege escalation on a network security appliance can give attackers deep access to enterprise infrastructure. CVE-2025-58325, disclosed in October 2025, lets authenticated users on Fortinet FortiOS systems bypass CLI command restrictions and execute privileged system commands. It affects a wide range of FortiOS versions, so many enterprise and government deployments are at risk of internal compromise.
Fortinet is a major global network security vendor, and its FortiGate product line is widely deployed in critical environments. The company serves hundreds of thousands of customers and is one of the main vendors in the firewall and unified threat management market. Because of that reach, FortiOS vulnerabilities affect network security worldwide.
Technical information
CVE-2025-58325 is classified under CWE-684 (Incorrect Provision of Specified Functionality). The flaw is in the FortiOS CLI command processing logic, where certain hidden or undocumented CLI command options are not properly restricted. A local authenticated attacker with CLI access can craft command syntax that gets past the intended restriction checks. That attacker can then execute privileged system commands that should only be available to higher-privileged accounts.
The vulnerability does not allow unauthenticated remote exploitation. Attackers need valid credentials for CLI access, such as SSH or console. Once authenticated, an attacker can send crafted CLI commands that exploit incomplete validation in the CLI parser. The result is privilege escalation and potential full system compromise.
No public code snippets or detailed exploit syntax had been disclosed when the advisory was published. The root cause is a failure in how FortiOS enforces CLI command restrictions, which lets crafted command input slip past them.
Affected systems and versions
CVE-2025-58325 affects the following FortiOS versions:
- 7.6.0
- 7.4.0 through 7.4.5
- 7.2.5 through 7.2.10
- 7.0.0 through 7.0.15
- All versions of 6.4
Any FortiGate appliance or system running these versions is vulnerable if an attacker has CLI access. Default and custom administrative configurations are both affected if they give untrusted users CLI access.
Vendor security history
Fortinet has a history of vulnerabilities in CLI and command processing components. Earlier issues include command injection and privilege escalation flaws in FortiOS, FortiADC, and other product lines. Notable examples are CVE-2021-44171 (privilege escalation via switch-control CLI) and FG-IR-24-325 (format string vulnerability in CLI). The vendor runs a regular PSIRT process and generally ships timely patches for supported versions, but end-of-support branches may not always receive fixes. The repeated CLI processing issues indicate that secure input validation and command restriction enforcement remain a problem for Fortinet.
