CVE-2025-31104

HighCVSS 7.2/10Last modified Aug 31, 2026

Description

A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiADC 7.6.0 through 7.6.1, FortiADC 7.4.0 through 7.4.6, FortiADC 7.2.0 through 7.2.7, FortiADC 7.1.0 through 7.1.4, FortiADC 7.0 all versions, FortiADC 6.2 all versions, FortiADC 6.1 all versions, FortiADC 6.0 all versions, FortiADC 5.4 all versions, FortiADC 5.3 all versions, FortiADC 5.2 all versions, FortiADC 5.1 all versions, FortiADC 5.0 all versions, FortiADC 4.8 all versions, FortiADC 4.7 all versions, FortiADC 4.6 all versions, FortiADC 4.5 all versions, FortiADC 4.4 all versions, FortiADC 4.3 all versions, FortiADC 4.2 all versions, FortiADC 4.1 all versions, FortiADC 4.0 all versions, FortiADC 3.2 all versions, FortiADC 3.1 all versions, FortiADC 3.0 all versions may allow attacker to execute unauthorized code or commands via <insert attack vector here>

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

Vendor	Product	Versions
Fortinet	FortiADC	>= 7.6.0, <= 7.6.1; >= 7.4.0, <= 7.4.6; >= 7.2.0, <= 7.2.7; >= 7.1.0, <= 7.1.4; >= 7.0.0, <= 7.0.6; >= 6.2.0, <= 6.2.6; >= 6.1.0, <= 6.1.6; >= 6.0.0, <= 6.0.4; >= 5.4.0, <= 5.4.5; >= 5.3.0, <= 5.3.7; >= 5.2.0, <= 5.2.8; >= 5.1.0, <= 5.1.7; >= 5.0.0, <= 5.0.4; >= 4.8.3, <= 4.8.8; >= 4.8.0, <= 4.8.1; >= 4.7.0, <= 4.7.3; >= 4.6.0, <= 4.6.2; >= 4.5.0, <= 4.5.4; >= 4.4.0, <= 4.4.1; >= 4.3.0, <= 4.3.2

References

https://fortiguard.fortinet.com/psirt/FG-IR-25-099Vendor Advisory

Timeline

Published: Jun 10, 2025
Last modified: Aug 31, 2026
NVD status: Modified

Related CVEs from 2025

CVE-2025-31116.5An issue has been discovered in GitLab CE/EE affecting all versions from 10.2 before 17.10.7, 17.11 before 17.11.3, and 18.0 before 18.0.1. CVE-2025-311149.3Fooocus is an image generating software. In versions 2.5.5 and prior, the Fooocus web UI is vulnerable to remote code execution due to the u CVE-2025-311158.7XZ Utils provide a general-purpose data-compression library plus command-line tools. In XZ Utils 5.3.3alpha to 5.8.0, the multithreaded .xz CVE-2025-311169.8Mobile Security Framework (MobSF) is a pen-testing, malware analysis and security assessment framework capable of performing static and dyna CVE-2025-311177.5OpenEMR is a free and open source electronic health records and medical practice management application. An Out-of-Band Server-Side Request CVE-2025-311187.1NamelessMC is a free, easy to use & powerful website software for Minecraft servers. In version 2.1.4 and prior, forum quick reply feature (CVE-2025-311197.6generator-jhipster-entity-audit is a JHipster module to enable entity audit and audit log page. Prior to 5.9.1, generator-jhipster-entity-au CVE-2025-31126.5CWE-400: Uncontrolled Resource Consumption vulnerability exists that could cause Denial of Service when an authenticated malicious user send CVE-2025-311205.3NamelessMC is a free, easy to use & powerful website software for Minecraft servers. In version 2.1.4 and prior, an insecure view count mech CVE-2025-311215.4OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 7.0.3.1, the Patient Image CVE-2025-311229.0scratch-coding-hut.github.io is the website for Coding Hut. In 1.0-beta3 and earlier, the login link can be used to login to any account by CVE-2025-311238.7Zitadel is open-source identity infrastructure software. A vulnerability existed where expired keys can be used to retrieve tokens. Specific