CVE-2025-64446: FortiWeb - Authentication Bypass
HoneyLabs honeypots recorded 3 probes matching CVE-2025-64446 from 2 distinct source IP addresses in the last 7 days, of which 1 on interactive sensors. Severity is rated critical.
This CVE is on CISA's Known Exploited Vulnerabilities list. CISA added it on 2025-11-14.
One source probed for CVE-2025-64446 on the interactive sensors. It did not send the exploit payload.
What the sensors show
All of them arrived on one day, 2026-11-02. One address, 79.124.49.102, sent 67% of them. The largest source network was AS50360 (Tamatiya EOOD), with 67% of the probes from 1 address. Over the last 90 days the sensors recorded 19 probes for it. Every probing client that negotiated TLS presented one JA4 fingerprint, t13i250900_b78ed14e2fd0_e7c285222651.
Request paths that identify it
- /api/v2.0/cmdb/system/admin%3f/../../../../../cgi-bin/fwbcgi
Addresses probing it
| Source IP | Probes | Network | Country |
|---|---|---|---|
| 79.124.49.102 | 2 | Tamatiya EOOD | Bulgaria |
| 66.92.21.200 | 1 | Psychz Networks | United States |
Networks it comes from
| ASN | Organisation | Probes | Source IPs |
|---|---|---|---|
| AS50360 | Tamatiya EOOD | 2 | 1 |
| AS40676 | Psychz Networks | 1 | 1 |
Where it comes from
| Country | Probes |
|---|---|
| Bulgaria | 2 |
| United States | 1 |
Captured requests
- /api/v2.0/cmdb/system/admin%3f/../../../../../cgi-bin/fwbcgi
Requests the interactive sensors answered
- POST /api/v2.0/cmdb/system/admin%3f/../../../../../cgi-bin/fwbcgi
HTTP client fingerprints
- b11cuq071_00050813_64f95b7c_xca3e
- b11cuq061_00050812_02ca6de1_xca3e
CVE report
Open a specific CVE from the CVE tracker.