Search: CVE-2025-25257

Fortinet FortiWeb contains a critical SQL injection vulnerability (CVE-2025-25257) that allows unauthenticated attackers to execute arbitrary SQL commands via crafted HTTP or HTTPS requests. This vulnerability has a high CVSS score of 9.6 and is known to be exploited in the wild. No specific affected versions or patch information is provided.

Silent Lynx is a persistent cyber espionage group active since 2024, targeting government ministries, diplomatic missions, and civil society organizations primarily in Central Asia and Commonwealth of Independent States countries. The group uses spear-phishing via compromised government email accounts and stages malware on GitHub repositories. Their operations involve exposed infrastructure such as open directories and newly registered domains. They employ a mix of lightweight reverse shells, PowerShell scripts, proprietary tools, and commodity utilities. Recent activity includes exploitation attempts using CVE-2025-8088 and interest in FortiWeb vulnerability CVE-2025-25257, with an expanded focus on Linux systems. Attribution suggests Russian-speaking operators likely based in Kazakhstan, targeting critical sectors like water resources and environmental organizations.

Campaign#silent lynx#chvostArmenia+8