{"id":"CVE-2025-25249","kind":"vulnerability","aliases":["CVE-2025-25249"],"related":[],"title":"A heap-based buffer overflow vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8,…","description":"Fortinet FortiOS, FortiSwitchManager, and FortiSASE contain a heap-based buffer overflow vulnerability that allows an attacker to execute unauthorized code or commands via specially crafted packets.\n\nCISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","summary":"Heap-based buffer overflow in the cw_acd (CAPWAP) daemon of FortiOS and FortiSwitchManager. A remote unauthenticated attacker can run code or commands with crafted requests. Fortinet notes ASLR and PIE raise exploitation difficulty. CISA added it to KEV on 2026-09-09. Fixed in FortiOS 7.6.4, 7.4.9, 7.2.12, 7.0.18; FortiOS 6.4 has no fix, so migrate. FortiSwitchManager fixed in 7.2.7 and 7.0.6.","severity":"critical","cvss":9.8,"epss":null,"exploited":true,"exploited_at":"2026-09-09T00:00:00+00:00","products":[{"name":"Fortinet Multiple Products","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"FortiOS","fixed":["7.6.4","7.4.9","7.2.12","7.0.18"],"affected":"7.6.0-7.6.3, 7.4.0-7.4.8, 7.2.0-7.2.11, 7.0.0-7.0.17, 6.4 all","ecosystem":"vendor"},{"name":"FortiSwitchManager","fixed":["7.2.7","7.0.6"],"affected":"7.2.0-7.2.6, 7.0.0-7.0.5","ecosystem":"vendor"},{"name":"fortinet fortios","fixed":["7.0.18"],"affected":">= 6.4.0, < 7.0.18","ecosystem":"vendor"},{"name":"fortinet fortios","fixed":["7.2.12"],"affected":">= 7.2.0, < 7.2.12","ecosystem":"vendor"},{"name":"fortinet fortios","fixed":["7.4.9"],"affected":">= 7.4.0, < 7.4.9","ecosystem":"vendor"},{"name":"fortinet fortios","fixed":["7.6.4"],"affected":">= 7.6.0, < 7.6.4","ecosystem":"vendor"},{"name":"fortinet fortiswitchmanager","fixed":["7.0.6"],"affected":">= 7.0.0, < 7.0.6","ecosystem":"vendor"},{"name":"fortinet fortiswitchmanager","fixed":["7.2.7"],"affected":">= 7.2.0, < 7.2.7","ecosystem":"vendor"},{"name":"fortinet fortisase","fixed":[],"affected":"= 25.1.39","ecosystem":"vendor"},{"name":"fortinet fortisase","fixed":[],"affected":"= 25.1.51","ecosystem":"vendor"},{"name":"siemens ruggedcom ape1808 firmware","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","firewall","fortios","fortisase","fortiswitchmanager","infrastructure","self-hosted"],"not_affected_if":["capwap-blocked-local-in","capwap-udp-5246-5249-blocked","fabric-access-disabled","no-fabric-allowaccess","unknown"],"how_to_check":"Run 'get system status' on the device and compare the version with the affected ranges. Then look for the 'fabric' service in allowaccess on any interface: 'show system interface' in the CLI. Interfaces with fabric enabled expose CAPWAP-CONTROL on UDP 5246-5249. Fabric on an interface exposed to untrusted networks is the highest risk.","fix":"Upgrade FortiOS 7.6 to 7.6.4+, 7.4 to 7.4.9+, 7.2 to 7.2.12+, 7.0 to 7.0.18+. FortiOS 6.4 (all versions): migrate to a fixed release. FortiSwitchManager 7.2 to 7.2.7+, 7.0 to 7.0.6+. Workaround 1: remove 'fabric' from allowaccess on each interface. Workaround 2: add a local-in policy that allows UDP 5246-5249 (CAPWAP-CONTROL) only from trusted device IPs and denies all others on interfaces with fabric enabled.","status":"open","published_at":"2026-01-13T17:15:56+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T20:31:35+00:00","updated_at":"2026-10-23T23:44:52+00:00","category":"infrastructure","confidence":0.85,"triage":{"at":"2026-10-23T20:31:35Z","model":"claude-haiku-5-5","output":{"fix":"Apply the mitigation from Fortinet's vendor advisory, as CISA requires. Fixed versions: unknown from the sources.","summary":"Fortinet FortiOS, FortiSwitchManager, and FortiSASE have a heap-based buffer overflow triggered by specially crafted packets. An attacker can run unauthorized code or commands on the affected device without credentials, and CISA lists it as exploited in the wild.","category":"infrastructure","who_cares":["fortios","fortiswitchmanager","fortisase","self-hosted","firewall"],"confidence":0.6,"analyst_note":"Find the Fortinet PSIRT advisory for CVE-2025-25249 to get affected and fixed FortiOS, FortiSwitchManager and FortiSASE versions, the mitigation steps and any version or config check; CISA KEV entry at https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-25249.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["unknown"],"severity_if_unknown":"critical"},"cost_usd":0.000419,"input_tokens":2227,"output_tokens":393,"severity_before":"unknown"},"analyst_status":"done","analyst_note":"Find the Fortinet PSIRT advisory for CVE-2025-25249 to get affected and fixed FortiOS, FortiSwitchManager and FortiSASE versions, the mitigation steps and any version or config check; CISA KEV entry at https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-25249.","search":"'-04':166C,192C,223C '-09':100B,101B '-2025':19A,22A '-25249':20A,23A '2026':99B '26':165C,191C,222C '6.4':110B '7.0.18':108B '7.0.6':121B '7.2.12':107B '7.2.7':119B '7.4.0':15A '7.4.8':17A '7.4.9':106B '7.6.0':11A '7.6.3':13A '7.6.4':105B 'accord':155C 'acd':66B 'action':151C 'add':94B 'adher':219C 'allow':136C 'ape1808':47A 'appli':152C 'applic':189C 'aslr':87B 'asset':213C 'attack':76B,138C 'base':4A,60B,131C,170C 'bod':164C,190C,221C 'buffer':5A,61B,132C 'capwap':67B 'cisa':93B,149C,162C,179C 'cloud':195C 'code':79B,142C 'command':81B,144C 'complianc':160C 'contain':127C 'craft':83B,147C 'cve':18A,21A 'cw':65B 'daemon':68B 'difficulti':92B 'discontinu':198C 'ensur':159C,218C 'evalu':211C 'execut':140C 'exploit':49B,91B 'exposur':216C 'firewal':50B 'firmware':48A 'fix':102B,113B,117B 'follow':188C 'forens':181C 'fortinet':9A,24A,29A,31A,33A,35A,37A,39A,41A,43A,85B,122C 'fortio':10A,14A,51B,70B,104B,109B,123C 'fortios':27A,30A,32A,34A,36A 'fortisas':52B,126C 'fortisase':42A,44A 'fortiswitchmanag':53B,72B,116B,124C 'fortiswitchmanager':28A,38A,40A 'guidanc':177C,193C 'guidelin':225C 'heap':3A,59B,130C 'heap-bas':2A,58B,129C 'host':57B 'infrastructur':54B 'instruct':158C 'internet':215C 'kev':97B 'migrat':115B 'mitig':153C,204C 'multiple':25A 'note':86B,176C,187C 'overflow':6A,62B,133C 'packet':148C 'patch':224C 'pie':89B 'priorit':167C 'product':202C 'products':26A 'rais':90B 'remot':74B 'request':84B 'requir':150C,183C 'respons':209C 'risk':172C 'ruggedcom':46A 'run':78B 'secur':168C 'see':173C,184C 'self':56B 'self-host':55B 'servic':196C 'siemens':45A 'special':146C 'stakehold':207C 'triag':182C 'unauthent':75B 'unauthor':141C 'unavail':206C 'updat':169C 'url':174C,185C 'use':199C 'vendor':157C 'via':145C 'vulner':7A,134C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-01-13T17:15:56+00:00","kev":{"dateAdded":"2026-09-09","dueDate":"2026-09-12","requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"psirt@fortinet.com","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2025-25249","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-25249","severity":null,"published_at":"2026-09-09T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T12:39:21+00:00","note":null},{"source":"analyst","external_id":"CVE-2025-25249:86","url":null,"severity":null,"published_at":"2026-10-23T21:29:00+00:00","modified_at":"2026-10-23T21:29:00+00:00","first_seen_at":"2026-10-23T21:29:00+00:00","fetched_at":"2026-10-23T21:29:00+00:00","note":"Read Fortinet PSIRT FG-IR-25-084 (primary). Affected/fixed versions from it. Fortinet page still says Known Exploited: No; exploited status comes from CISA KEV (added 2026-09-09, per Cyber Centre AV26-023). No public PoC found (not searched deeply). FortiSASE is listed by NVD/GHSA/Cyber Centre (25.2.b, 25.1.a.2) but not in the PSIRT table; no FortiSASE fixed version read. Fortinet CVSS 8.1 High, NVD 9.8."},{"source":"analyst","external_id":"CVE-2025-25249:144","url":null,"severity":null,"published_at":"2026-10-23T21:57:02+00:00","modified_at":"2026-10-23T21:57:02+00:00","first_seen_at":"2026-10-23T21:57:02+00:00","fetched_at":"2026-10-23T21:57:02+00:00","note":"Read Fortinet PSIRT FG-IR-25-084 (updated 2026-02-23): versions/workarounds confirmed; FortiSASE is not listed in the advisory. PSIRT still says Known Exploited: No, but the signal's CISA KEV entry (2026-09-09) says exploited, so the PSIRT page is stale on that. No public PoC found; X had 1 post in 7d, none worth citing. Advisory severity High, CVSS 8.1."},{"source":"nvd","external_id":"CVE-2025-25249","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-25249","severity":null,"published_at":"2026-01-13T17:15:56+00:00","modified_at":"2026-10-07T18:17:13+00:00","first_seen_at":"2026-10-23T23:44:52+00:00","fetched_at":"2026-10-23T23:44:52+00:00","note":null}],"documents":[{"id":1033,"url":"https://fortiguard.fortinet.com/psirt/FG-IR-25-084","title":"Fortinet FG-IR-25-084 cw_acd heap overflow","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1036,"url":"https://www.cyber.gc.ca/en/alerts-advisories/fortinet-security-advisory-av26-023","title":"Cyber Centre AV26-023 (KEV update)","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":1038,"url":"https://nvd.nist.gov/vuln/detail/cve-2025-25249","title":"NVD CVE-2025-25249","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}