CVE-2025-32756

Published May 13, 2025

Last updated 3 months ago

Fortinet

FortiVoice

Overview

AI description

Automated description summarized from trusted sources.

CVE-2025-32756 is a stack-based buffer overflow vulnerability that affects multiple Fortinet products, including FortiVoice, FortiMail, FortiNDR, FortiRecorder, and FortiCamera. This vulnerability allows a remote, unauthenticated attacker to execute arbitrary code or commands by sending specially crafted HTTP requests. Fortinet has observed active exploitation of this vulnerability in the wild, specifically targeting FortiVoice systems. During the exploitation of CVE-2025-32756, threat actors have been observed performing network scans, deleting system crash logs to conceal their activity, and enabling 'fcgi debugging' to log credentials. Additionally, they have been seen deploying malware, establishing cron jobs to harvest credentials, and using scripts to conduct network reconnaissance on compromised devices.

Description: A stack-based buffer overflow vulnerability [CWE-121] in Fortinet FortiVoice versions 7.2.0, 7.0.0 through 7.0.6, 6.4.0 through 6.4.10, FortiRecorder versions 7.2.0 through 7.2.3, 7.0.0 through 7.0.5, 6.4.0 through 6.4.5, FortiMail versions 7.6.0 through 7.6.2, 7.4.0 through 7.4.4, 7.2.0 through 7.2.7, 7.0.0 through 7.0.8, FortiNDR versions 7.6.0, 7.4.0 through 7.4.7, 7.2.0 through 7.2.4, 7.0.0 through 7.0.6, FortiCamera versions 2.1.0 through 2.1.3, 2.0 all versions, 1.1 all versions, allows a remote unauthenticated attacker to execute arbitrary code or commands via sending HTTP requests with specially crafted hash cookie.
Source: psirt@fortinet.com
NVD status: Analyzed
Products: fortimail, fortindr, fortirecorder, fortivoice, forticamera_firmware

Risk scores

CVSS 3.1

Type: Primary
Base score: 9.8
Impact score: 5.9
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity: CRITICAL

Known exploits

Data from CISA

Vulnerability name: Fortinet Multiple Products Stack-Based Buffer Overflow Vulnerability
Exploit added on: May 14, 2025
Exploit action due: Jun 4, 2025
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Weaknesses

psirt@fortinet.com: CWE-121
nvd@nist.gov: CWE-787

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:fortinet:fortimail:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "F05ACB93-42BC-43CD-845F-35FA9FE1D92D",
            "versionEndExcluding": "7.0.9",
            "versionStartIncluding": "7.0.0"
          },
          {
            "criteria": "cpe:2.3:a:fortinet:fortimail:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "8395970D-F937-4D1C-9FE1-90348F33FA94",
            "versionEndExcluding": "7.2.8",
            "versionStartIncluding": "7.2.0"
          },
          {
            "criteria": "cpe:2.3:a:fortinet:fortimail:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "3A40DE6A-D852-4B7E-BA67-B5DBBB3D427C",
            "versionEndExcluding": "7.4.5",
            "versionStartIncluding": "7.4.0"
          },
          {
            "criteria": "cpe:2.3:a:fortinet:fortimail:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "F2F1655C-A21F-4FD3-875C-4E1DD8A7E178",
            "versionEndExcluding": "7.6.3",
            "versionStartIncluding": "7.6.0"
          },
          {
            "criteria": "cpe:2.3:a:fortinet:fortindr:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "039768AE-7C53-48E2-ADEE-77AE304B3D36",
            "versionEndExcluding": "7.0.7",
            "versionStartIncluding": "7.0.0"
          },
          {
            "criteria": "cpe:2.3:a:fortinet:fortindr:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "25383BFB-4CBE-4577-8AB7-4259D03B5B6F",
            "versionEndExcluding": "7.2.5",
            "versionStartIncluding": "7.2.0"
          },
          {
            "criteria": "cpe:2.3:a:fortinet:fortindr:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "68F2B9B7-29FE-4CDD-8638-33CA947AB466",
            "versionEndExcluding": "7.4.8",
            "versionStartIncluding": "7.4.0"
          },
          {
            "criteria": "cpe:2.3:a:fortinet:fortindr:1.1.0:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "0A64D6DA-FC2D-4411-9ADF-7103C0EA652E"
          },
          {
            "criteria": "cpe:2.3:a:fortinet:fortindr:1.2.0:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "90B58E2B-7304-49FB-9454-ED9FFBCEE697"
          },
          {
            "criteria": "cpe:2.3:a:fortinet:fortindr:1.3.0:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "9C0A1B68-65DC-4267-939A-216758809DC5"
          },
          {
            "criteria": "cpe:2.3:a:fortinet:fortindr:1.4.0:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "EF813322-7AF8-4F9C-82D9-DBEF8888B97B"
          },
          {
            "criteria": "cpe:2.3:a:fortinet:fortindr:1.5.0:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "86DD4A5F-260B-446D-8891-069A34D31760"
          },
          {
            "criteria": "cpe:2.3:a:fortinet:fortindr:7.1.0:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "888692FD-3219-49D3-898C-F4EA84CCC6CF"
          },
          {
            "criteria": "cpe:2.3:a:fortinet:fortindr:7.1.1:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "874D4928-620B-42FE-8B19-C4314C46739A"
          },
          {
            "criteria": "cpe:2.3:a:fortinet:fortindr:7.6.0:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "9A1D8AE9-D9F9-402C-B8EB-58189200E0D6"
          },
          {
            "criteria": "cpe:2.3:a:fortinet:fortirecorder:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "A54116E5-DAA0-4D49-A2EE-FA9F9DF0D003",
            "versionEndExcluding": "6.4.6",
            "versionStartIncluding": "6.4.0"
          },
          {
            "criteria": "cpe:2.3:a:fortinet:fortirecorder:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "EF6B0F6E-6044-4F62-8AB5-A832A0554B9F",
            "versionEndExcluding": "7.0.6",
            "versionStartIncluding": "7.0.0"
          },
          {
            "criteria": "cpe:2.3:a:fortinet:fortirecorder:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "55A5E420-BCAF-4399-9223-A4398760CD87",
            "versionEndExcluding": "7.2.4",
            "versionStartIncluding": "7.2.0"
          },
          {
            "criteria": "cpe:2.3:a:fortinet:fortivoice:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "408D5EE5-B951-4022-A4DF-0295A04899E5",
            "versionEndExcluding": "6.4.11",
            "versionStartIncluding": "6.4.0"
          },
          {
            "criteria": "cpe:2.3:a:fortinet:fortivoice:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "58472BB4-2426-44B5-8D17-9C984EA567EB",
            "versionEndExcluding": "7.0.7",
            "versionStartIncluding": "7.0.0"
          },
          {
            "criteria": "cpe:2.3:a:fortinet:fortivoice:7.2.0:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "76B48D4B-338A-4CEB-8712-6D880FF0F034"
          }
        ],
        "operator": "OR"
      }
    ]
  },
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:o:fortinet:forticamera_firmware:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "9592F0E2-1BCA-42D3-95E1-868A18E66557",
            "versionEndExcluding": "2.4.0",
            "versionStartIncluding": "2.0.0"
          }
        ],
        "operator": "OR"
      },
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:h:fortinet:forticamera:-:*:*:*:*:*:*:*",
            "vulnerable": false,
            "matchCriteriaId": "CFB863FD-5593-4620-8740-4EB692EA58E1"
          }
        ],
        "operator": "OR"
      }
    ],
    "operator": "AND"
  },
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:o:fortinet:forticamera_firmware:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "A5FD90AB-29F2-40F1-8591-D046850906F7",
            "versionEndIncluding": "1.1.5",
            "versionStartIncluding": "1.1.0"
          }
        ],
        "operator": "OR"
      },
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:h:fortinet:forticamera:-:*:*:*:*:*:*:*",
            "vulnerable": false,
            "matchCriteriaId": "CFB863FD-5593-4620-8740-4EB692EA58E1"
          }
        ],
        "operator": "OR"
      }
    ],
    "operator": "AND"
  }
]

References

Sources include official advisories and independent security research.