--- id: "CVE-2025-32756" kind: "vulnerability" aliases: ["CVE-2025-32756"] title: "A stack-based buffer overflow vulnerability [CWE-121] vulnerability in Fortinet FortiCamera 2.1.0 through 2.1.3,\u2026" severity: "critical" cvss: 9.8 epss: null exploited: true status: "open" category: "infrastructure" products: [{"name": "Fortinet Multiple Products", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "fortinet fortimail", "fixed": ["7.0.9"], "affected": ">= 7.0.0, < 7.0.9", "ecosystem": "vendor"}, {"name": "fortinet fortimail", "fixed": ["7.2.8"], "affected": ">= 7.2.0, < 7.2.8", "ecosystem": "vendor"}, {"name": "fortinet fortimail", "fixed": ["7.4.5"], "affected": ">= 7.4.0, < 7.4.5", "ecosystem": "vendor"}, {"name": "fortinet fortimail", "fixed": ["7.6.3"], "affected": ">= 7.6.0, < 7.6.3", "ecosystem": "vendor"}, {"name": "fortinet fortindr", "fixed": ["7.0.7"], "affected": ">= 7.0.0, < 7.0.7", "ecosystem": "vendor"}, {"name": "fortinet fortindr", "fixed": ["7.2.5"], "affected": ">= 7.2.0, < 7.2.5", "ecosystem": "vendor"}, {"name": "fortinet fortindr", "fixed": ["7.4.8"], "affected": ">= 7.4.0, < 7.4.8", "ecosystem": "vendor"}, {"name": "fortinet fortindr", "fixed": [], "affected": "= 1.1.0", "ecosystem": "vendor"}, {"name": "fortinet fortindr", "fixed": [], "affected": "= 1.2.0", "ecosystem": "vendor"}, {"name": "fortinet fortindr", "fixed": [], "affected": "= 1.3.0", "ecosystem": "vendor"}, {"name": "fortinet fortindr", "fixed": [], "affected": "= 1.4.0", "ecosystem": "vendor"}, {"name": "fortinet fortindr", "fixed": [], "affected": "= 1.5.0", "ecosystem": "vendor"}, {"name": "fortinet fortindr", "fixed": [], "affected": "= 7.1.0", "ecosystem": "vendor"}, {"name": "fortinet fortindr", "fixed": [], "affected": "= 7.1.1", "ecosystem": "vendor"}, {"name": "fortinet fortindr", "fixed": [], "affected": "= 7.6.0", "ecosystem": "vendor"}, {"name": "fortinet fortirecorder", "fixed": ["6.4.6"], "affected": ">= 6.4.0, < 6.4.6", "ecosystem": "vendor"}, {"name": "fortinet fortirecorder", "fixed": ["7.0.6"], "affected": ">= 7.0.0, < 7.0.6", "ecosystem": "vendor"}, {"name": "fortinet fortirecorder", "fixed": ["7.2.4"], "affected": ">= 7.2.0, < 7.2.4", "ecosystem": "vendor"}, {"name": "fortinet fortivoice", "fixed": ["6.4.11"], "affected": ">= 6.4.0, < 6.4.11", "ecosystem": "vendor"}, {"name": "fortinet fortivoice", "fixed": ["7.0.7"], "affected": ">= 7.0.0, < 7.0.7", "ecosystem": "vendor"}, {"name": "fortinet fortivoice", "fixed": [], "affected": "= 7.2.0", "ecosystem": "vendor"}, {"name": "fortinet forticamera firmware", "fixed": [], "affected": ">= 2.0.0, <= 2.1.3", "ecosystem": "vendor"}, {"name": "fortinet forticamera firmware", "fixed": [], "affected": ">= 1.1.0, <= 1.1.5", "ecosystem": "vendor"}] ecosystems: ["vendor"] tags: ["exploited", "fortifone", "fortimail", "fortindr", "fortivoice", "infrastructure", "self-hosted"] not_affected_if: ["unaffected-product-version"] published_at: "2025-05-13T15:15:57+00:00" first_seen_at: "2026-10-23T19:11:51+00:00" updated_at: "2026-10-23T22:29:05+00:00" sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-32756", "first_seen_at": "2026-10-23T19:11:51+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-32756", "first_seen_at": "2026-10-23T22:29:05+00:00"}] --- # A stack-based buffer overflow vulnerability [CWE-121] vulnerability in Fortinet FortiCamera 2.1.0 through 2.1.3,… Fortinet FortiFone, FortiVoice, FortiNDR and FortiMail contain a stack-based buffer overflow reachable through crafted HTTP requests. A remote attacker with no account can run arbitrary code or commands on the device. _Summary, check and fix written by a model from the sources; labelled as such._ ## Affected - vendor:Fortinet Multiple Products affected ? fixed ? - vendor:fortinet fortimail affected >= 7.0.0, < 7.0.9 fixed 7.0.9 - vendor:fortinet fortimail affected >= 7.2.0, < 7.2.8 fixed 7.2.8 - vendor:fortinet fortimail affected >= 7.4.0, < 7.4.5 fixed 7.4.5 - vendor:fortinet fortimail affected >= 7.6.0, < 7.6.3 fixed 7.6.3 - vendor:fortinet fortindr affected >= 7.0.0, < 7.0.7 fixed 7.0.7 - vendor:fortinet fortindr affected >= 7.2.0, < 7.2.5 fixed 7.2.5 - vendor:fortinet fortindr affected >= 7.4.0, < 7.4.8 fixed 7.4.8 - vendor:fortinet fortindr affected = 1.1.0 fixed ? - vendor:fortinet fortindr affected = 1.2.0 fixed ? - vendor:fortinet fortindr affected = 1.3.0 fixed ? - vendor:fortinet fortindr affected = 1.4.0 fixed ? - vendor:fortinet fortindr affected = 1.5.0 fixed ? - vendor:fortinet fortindr affected = 7.1.0 fixed ? - vendor:fortinet fortindr affected = 7.1.1 fixed ? - vendor:fortinet fortindr affected = 7.6.0 fixed ? - vendor:fortinet fortirecorder affected >= 6.4.0, < 6.4.6 fixed 6.4.6 - vendor:fortinet fortirecorder affected >= 7.0.0, < 7.0.6 fixed 7.0.6 - vendor:fortinet fortirecorder affected >= 7.2.0, < 7.2.4 fixed 7.2.4 - vendor:fortinet fortivoice affected >= 6.4.0, < 6.4.11 fixed 6.4.11 - vendor:fortinet fortivoice affected >= 7.0.0, < 7.0.7 fixed 7.0.7 - vendor:fortinet fortivoice affected = 7.2.0 fixed ? - vendor:fortinet forticamera firmware affected >= 2.0.0, <= 2.1.3 fixed ? - vendor:fortinet forticamera firmware affected >= 1.1.0, <= 1.1.5 fixed ? ## Fix Apply the mitigations and patches per Fortinet's vendor advisory, as directed by CISA; the specific fixed versions are unknown from these sources. If no mitigation is available, discontinue use of the affected product. ## Timeline - 2026-10-23T19:11:51+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-32756 - 2026-10-23T22:29:05+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2025-32756 ## From the sources A stack-based buffer overflow vulnerability [CWE-121] vulnerability in Fortinet FortiCamera 2.1.0 through 2.1.3, FortiCamera 2.0 all versions, FortiCamera 1.1 all versions, FortiMail 7.6.0 through 7.6.2, FortiMail 7.4.0 through 7.4.4, FortiMail 7.2.0 through 7.2.7, FortiMail 7.0.0 through 7.0.8, FortiNDR 7.6.0, FortiNDR 7.4.0 through 7.4.7, FortiNDR 7.2.0 through 7.2.4, FortiNDR 7.0.0 through 7.0.6, FortiRecorder 7.2.0 through 7.2.3, FortiRecorder 7.0.0 through 7.0.5, FortiRecorder 6.4.0 through 6.4.5, FortiVoice 7.2.0, FortiVoice 7.0.0 through 7.0.6, FortiVoice 6.4.0 through 6.4.10 allows a remote unauthenticated attacker to execute arbitrary code or commands via sending HTTP requests with specially crafted hash cookie. --- _Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_