CVE-2025-62675

Name of the Vulnerable Software and Affected Versions FortiOS versions 7.6.0 through 7.6.4 FortiOS versions 7.4.x FortiOS versions 7.2.x FortiProxy versions 7.6.0 through 7.6.4 FortiProxy versions 7.4.x FortiProxy versions 7.2.x

Description An improper neutralization of CRLF (Carriage Return Line Feed) sequences in HTTP headers, also known as HTTP Response Splitting, allows a remote attacker with a valid web filter override token to inject arbitrary headers by tricking a user into clicking a crafted link. This issue may lead to the execution of arbitrary code.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.