Sharing insights and taking swift action can collectively reduce the impact of these threats. This is your call to action for real-time threat intelligence and collaborative cybersecurity.

For more information, visit http://crowdsec.net

Want to stay ahead of the latest cyber threats? Get our weekly Threat Alert delivered straight to your inbox, along with critical threat updates and trending cybersecurity insights.

Sign up now for exclusive access: https://contact.crowdsec.net/threat-alert

6/6

How to protect your systems:
Patch: Patch your FortiWeb instance if it is publicly exposed; otherwise, remove outside access to the affected admin panel.
Preemptive blocking: Use Crowdsec CTI to block IPs exploiting CVE-2025-25257 https://app.crowdsec.net/cti?q=cves%3A%22CVE-2025-25257%22&page=1
Stay proactive: Install the Crowdsec Web Application Firewall to stay ahead of exploit attempts, with 100+ virtual patching rules available. https://doc.crowdsec.net/docs/next/appsec/intro

5/6

Key findings:
A new SQL injection vulnerability in a FortiWeb component allows attackers to execute arbitrary code on the affected machine.
CrowdSec has been tracking exploitation since the 11th of July 2025.
Data from the CrowdSec network indicates that attacker interest in the vulnerability remains very limited.

2/6

Trend analysis:
CrowdSec detected the first in-the-wild exploitation of this vulnerability on July 11th, shortly after we rolled out detection rules. Using our wayback tools, we were able to establish that there were no exploitation attempts before July 11th, confirming once again that public exploits are a key driver of vulnerability weaponization.
For CVE-2025-25257, CrowdSec has observed about 40 distinct IPs producing about 500 attack events in total. Most of these attacks occurred on Friday, July 11th, the day the exploit was publicized. The attacks on Friday were mainly due to a presumably coordinated attacker spinning up a bunch of machines on Scaleway cloud to use in a broad scanning campaign. Over the weekend, the exploit quickly lost popularity. This might be due to the fact that the exploit requires the Fabric Connector administrative interface to be publicly accessible, which is somewhat unlikely. While we cannot make predictions, CrowdSec expects exploitation signals to pick up slightly this week as vulnerability scanners start looking for vulnerable devices. However, we don’t expect the attacker volume for this vulnerability to reach that of other Fortinet-related CVEs.

4/6

About the exploit:
The Fortinet FortiWeb Fabric Connector is an integration component designed to enhance application security by linking FortiWeb web application firewalls (WAFs) with other elements of the Fortinet Security Stack. It enables policy enforcement and automated threat response by leveraging intelligence gathered from FortiGate firewalls, FortiSandbox, FortiAnalyzer, and other “Fabric-enabled” devices. It is in some sense a glue product that holds an array of different Fortinet products together.
The vulnerability allows unauthenticated attackers to execute arbitrary SQL statements against the MySQL database connected to Fabric Connector. As this database runs as root per default, this attack can be chained to run arbitrary Python code on the affected machine, allowing attackers to further compromise the system. The vulnerability affects various FortiWeb versions from 7.0 to 7.6. As a workaround, the vendor recommends disabling the administrative interface to external visitors.

3/6

@Cyberneurones Dans ce même sujet, j’utilise #crowdsec depuis un mois et il me semble pas mal. C'est une manière à grande échelle de partager les IP qui t'attaquent et de profiter de la même information de la communauté.

@kubikpixel @nixCraft Oops.... Too late for my #Crowdsec deployment to my homelab. Hope for the best :-)

My aim for the next day, was to setup a Dashboard for #crowdsec. There is a Web Application hosted by CrowdSec, but they have a limit of 500 Alerts per month. Since many IPs try to brute force my ssh login (I disabled password login, btw), I reach this quota in the first week of a month. Very sad.

So I did some research and figured out, the most generic solution is to use the metric Endpoint, which is compatible with #prometheus I also found an office dashboard from CrowdSec for #grafana!

So my goals were set. I started with Prometheus and collected the metrics (no big deal). Then I got my Grafana up and running and configured the data source for Prometheus. After that imported the Dashboard and I just worked!

Now I got hyped and also added my reverse proxy Traefik to the Prometheus jobs. There was a very up-to-date dashboard for Traefik which I could use. Now I can also display what services are used the most and see more insights of my home lab.
The rest of the day, I used to tweak my dashboards. Now I can see in a Donate Diagram the usage of my services :D See the screenshots below.

3/4