CVE-2025-67685

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-67685
A Server-Side Request Forgery (SSRF) vulnerability [CWE-918] vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.4, FortiSandbox 4.4 all versions, FortiSandbox 4.2 all versions, FortiSandbox 4.0 all versions may allow an authenticated attacker to proxy internal requests limited to plaintext endpoints only via crafted HTTP requests.

3.8 /10

CVSS v3 : LOW

V3 Legend

Vector :

Exploitability : 1.2 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://fortiguard.fortinet.com/psirt/FG-IR-25-783 Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:fortinet:fortisandbox:*:*:*:*:*:*:*:*
History

14 Jan 2026, 21:38

Type Values Removed Values Added
References () https://fortiguard.fortinet.com/psirt/FG-IR-25-783 - () https://fortiguard.fortinet.com/psirt/FG-IR-25-783 - Vendor Advisory
CPE cpe:2.3:a:fortinet:fortisandbox:*:*:*:*:*:*:*:*
First Time Fortinet
Fortinet fortisandbox

13 Jan 2026, 17:15

Type Values Removed Values Added
New CVE
Information

Published : 2026-01-13 17:15

Updated : 2026-01-14 21:38

NVD link : CVE-2025-67685

Mitre link : CVE-2025-67685

CVE.ORG link : CVE-2025-67685

JSON object : View

Products Affected

fortinet

  • fortisandbox
CWE
CWE-918

Server-Side Request Forgery (SSRF)