--- id: "CVE-2025-25249" kind: "vulnerability" aliases: ["CVE-2025-25249"] title: "A heap-based buffer overflow vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8,\u2026" severity: "critical" cvss: 9.8 epss: null exploited: true status: "open" category: "infrastructure" products: [{"name": "Fortinet Multiple Products", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "FortiOS", "fixed": ["7.6.4", "7.4.9", "7.2.12", "7.0.18"], "affected": "7.6.0-7.6.3, 7.4.0-7.4.8, 7.2.0-7.2.11, 7.0.0-7.0.17, 6.4 all", "ecosystem": "vendor"}, {"name": "FortiSwitchManager", "fixed": ["7.2.7", "7.0.6"], "affected": "7.2.0-7.2.6, 7.0.0-7.0.5", "ecosystem": "vendor"}, {"name": "fortinet fortios", "fixed": ["7.0.18"], "affected": ">= 6.4.0, < 7.0.18", "ecosystem": "vendor"}, {"name": "fortinet fortios", "fixed": ["7.2.12"], "affected": ">= 7.2.0, < 7.2.12", "ecosystem": "vendor"}, {"name": "fortinet fortios", "fixed": ["7.4.9"], "affected": ">= 7.4.0, < 7.4.9", "ecosystem": "vendor"}, {"name": "fortinet fortios", "fixed": ["7.6.4"], "affected": ">= 7.6.0, < 7.6.4", "ecosystem": "vendor"}, {"name": "fortinet fortiswitchmanager", "fixed": ["7.0.6"], "affected": ">= 7.0.0, < 7.0.6", "ecosystem": "vendor"}, {"name": "fortinet fortiswitchmanager", "fixed": ["7.2.7"], "affected": ">= 7.2.0, < 7.2.7", "ecosystem": "vendor"}, {"name": "fortinet fortisase", "fixed": [], "affected": "= 25.1.39", "ecosystem": "vendor"}, {"name": "fortinet fortisase", "fixed": [], "affected": "= 25.1.51", "ecosystem": "vendor"}, {"name": "siemens ruggedcom ape1808 firmware", "fixed": [], "affected": "", "ecosystem": "vendor"}] ecosystems: ["vendor"] tags: ["exploited", "firewall", "fortios", "fortisase", "fortiswitchmanager", "infrastructure", "self-hosted"] not_affected_if: ["capwap-blocked-local-in", "capwap-udp-5246-5249-blocked", "fabric-access-disabled", "no-fabric-allowaccess", "unknown"] published_at: "2026-01-13T17:15:56+00:00" first_seen_at: "2026-10-23T19:11:51+00:00" updated_at: "2026-10-23T23:44:52+00:00" sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-25249", "first_seen_at": "2026-10-23T19:11:51+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T21:29:00+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T21:57:02+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-25249", "first_seen_at": "2026-10-23T23:44:52+00:00"}] --- # A heap-based buffer overflow vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8,… Heap-based buffer overflow in the cw_acd (CAPWAP) daemon of FortiOS and FortiSwitchManager. A remote unauthenticated attacker can run code or commands with crafted requests. Fortinet notes ASLR and PIE raise exploitation difficulty. CISA added it to KEV on 2026-09-09. Fixed in FortiOS 7.6.4, 7.4.9, 7.2.12, 7.0.18; FortiOS 6.4 has no fix, so migrate. FortiSwitchManager fixed in 7.2.7 and 7.0.6. _Summary, check and fix written by a model from the sources; labelled as such._ ## Affected - vendor:Fortinet Multiple Products affected ? fixed ? - vendor:FortiOS affected 7.6.0-7.6.3, 7.4.0-7.4.8, 7.2.0-7.2.11, 7.0.0-7.0.17, 6.4 all fixed 7.6.4, 7.4.9, 7.2.12, 7.0.18 - vendor:FortiSwitchManager affected 7.2.0-7.2.6, 7.0.0-7.0.5 fixed 7.2.7, 7.0.6 - vendor:fortinet fortios affected >= 6.4.0, < 7.0.18 fixed 7.0.18 - vendor:fortinet fortios affected >= 7.2.0, < 7.2.12 fixed 7.2.12 - vendor:fortinet fortios affected >= 7.4.0, < 7.4.9 fixed 7.4.9 - vendor:fortinet fortios affected >= 7.6.0, < 7.6.4 fixed 7.6.4 - vendor:fortinet fortiswitchmanager affected >= 7.0.0, < 7.0.6 fixed 7.0.6 - vendor:fortinet fortiswitchmanager affected >= 7.2.0, < 7.2.7 fixed 7.2.7 - vendor:fortinet fortisase affected = 25.1.39 fixed ? - vendor:fortinet fortisase affected = 25.1.51 fixed ? - vendor:siemens ruggedcom ape1808 firmware affected ? fixed ? ## How to check Run 'get system status' on the device and compare the version with the affected ranges. Then look for the 'fabric' service in allowaccess on any interface: 'show system interface' in the CLI. Interfaces with fabric enabled expose CAPWAP-CONTROL on UDP 5246-5249. Fabric on an interface exposed to untrusted networks is the highest risk. ## Fix Upgrade FortiOS 7.6 to 7.6.4+, 7.4 to 7.4.9+, 7.2 to 7.2.12+, 7.0 to 7.0.18+. FortiOS 6.4 (all versions): migrate to a fixed release. FortiSwitchManager 7.2 to 7.2.7+, 7.0 to 7.0.6+. Workaround 1: remove 'fabric' from allowaccess on each interface. Workaround 2: add a local-in policy that allows UDP 5246-5249 (CAPWAP-CONTROL) only from trusted device IPs and denies all others on interfaces with fabric enabled. ## Timeline - 2026-10-23T19:11:51+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-25249 - 2026-10-23T21:29:00+00:00 analyst — Read Fortinet PSIRT FG-IR-25-084 (primary). Affected/fixed versions from it. Fortinet page still says Known Exploited: No; exploited status comes from CISA KEV (added 2026-09-09, per Cyber Centre AV26-023). No public PoC found (not searched deeply). FortiSASE is listed by NVD/GHSA/Cyber Centre (25.2.b, 25.1.a.2) but not in the PSIRT table; no FortiSASE fixed version read. Fortinet CVSS 8.1 High, NVD 9.8. - 2026-10-23T21:57:02+00:00 analyst — Read Fortinet PSIRT FG-IR-25-084 (updated 2026-02-23): versions/workarounds confirmed; FortiSASE is not listed in the advisory. PSIRT still says Known Exploited: No, but the signal's CISA KEV entry (2026-09-09) says exploited, so the PSIRT page is stale on that. No public PoC found; X had 1 post in 7d, none worth citing. Advisory severity High, CVSS 8.1. - 2026-10-23T23:44:52+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2025-25249 ## Documents - [advisory] Fortinet FG-IR-25-084 cw_acd heap overflow https://fortiguard.fortinet.com/psirt/FG-IR-25-084 - [describes] Cyber Centre AV26-023 (KEV update) https://www.cyber.gc.ca/en/alerts-advisories/fortinet-security-advisory-av26-023 - [mentions] NVD CVE-2025-25249 https://nvd.nist.gov/vuln/detail/cve-2025-25249 ## From the sources Fortinet FortiOS, FortiSwitchManager, and FortiSASE contain a heap-based buffer overflow vulnerability that allows an attacker to execute unauthorized code or commands via specially crafted packets. CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. --- _Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_