Fortinet fixed two critical flaws in FortiFone and FortiSIEM

Fortinet has released patches for six vulnerabilities, including two critical flaws in FortiFone and FortiSIEM that could be exploited without authentication to leak configuration data or execute code.

The first flaw, CVE-2025-64155, carries a CVSS of 9.4 and involves improper neutralisation of special elements used in an OS command, enabling an unauthenticated attacker to run code via crafted TCP requests in FortiSIEM; the vulnerability affects multiple FortiSIEM versions with upgrade guidance provided for each, including 7.4 through 7.3 lines.

The second critical flaw, CVE-2025-47855, has a CVSS of 9.3 and exposes sensitive information through the FortiFone Web Portal, allowing an unauthenticated attacker to obtain device configuration via crafted HTTP or HTTPS requests; FortiFone versions 3.0.24 and 7.0.2 were addressed. The advisory also notes that the vulnerability in FortiSIEM is limited to the Super and Worker nodes and does not affect Collector nodes, with a recommended workaround of restricting access to the phMonitor port 7900.

It is unclear whether either flaw is being actively exploited in the wild. Fortinet lists the affected FortiSIEM 7.5 and lower versions with upgrade paths to fixed releases.