This vulnerability (CVE-2025-67862) affects Fortinet FortiOS versions 6.4 all versions, 7.0.0 through 7.0.16, 7.2.0 through 7.2.10, 7.4.0 through 7.4.7, and 7.6.0 through 7.6.2, as well as FortiProxy versions 7.0 all versions, 7.2.0 through 7.2.14, 7.4.0 through 7.4.10, and 7.6.0 through 7.6.3. It allows an authenticated administrator to execute Lua scripts via specially crafted CLI commands due to an internal asset exposed to unsafe debug access level or state. The vulnerability is classified under CWE-1244 and has a CVSS v3.1 base score of 6.0, indicating medium severity. The vendor has released an official fix to remediate this issue.

An authenticated administrator could exploit this vulnerability to execute arbitrary Lua scripts on affected FortiOS or FortiProxy devices. This could lead to full compromise of confidentiality, integrity, and availability of the affected system. The CVSS vector indicates local attack vector with low attack complexity and high privileges required, no user interaction, and complete impact on confidentiality, integrity, and availability.

An official fix is available from Fortinet to address this vulnerability. It is recommended to apply the vendor-provided patches promptly to affected FortiOS and FortiProxy versions. Since the vulnerability requires authenticated administrator access, ensure that administrative credentials are protected and access is limited. No additional vendor advisories indicate that no action is required or that the issue is already mitigated.