WHEN THE IMPERSONATION FUNCTION GETS USED TO IMPERSONATE USERS (FORTINET FORTIWEB AUTH. BYPASS CVE-2025-64446)

Summary from the TLDR InfoSec newsletter

Fortinet FortiWeb appliances are being actively exploited via CVE-2025-64446, a pre-auth RCE chain combining path traversal and authentication bypass that allows attackers to reach privileged CGI functions and impersonate users by crafting a base64-encoded CGIINFO header containing admin credentials. The vulnerability was silently patched in version 8.0.2 and affects multiple FortiWeb versions. It enables complete appliance compromise through administrative account creation. WatchTowr released a detection tool on GitHub to identify vulnerable hosts.