CVE-2025-32756

Published May 13, 2025

Last updated 2 months ago

Exploit known CVSS critical 9.8

Fortinet

FortiVoice

Overview

Description: A stack-based buffer overflow vulnerability [CWE-121] vulnerability in Fortinet FortiCamera 2.1.0 through 2.1.3, FortiCamera 2.0 all versions, FortiCamera 1.1 all versions, FortiMail 7.6.0 through 7.6.2, FortiMail 7.4.0 through 7.4.4, FortiMail 7.2.0 through 7.2.7, FortiMail 7.0.0 through 7.0.8, FortiNDR 7.6.0, FortiNDR 7.4.0 through 7.4.7, FortiNDR 7.2.0 through 7.2.4, FortiNDR 7.0.0 through 7.0.6, FortiRecorder 7.2.0 through 7.2.3, FortiRecorder 7.0.0 through 7.0.5, FortiRecorder 6.4.0 through 6.4.5, FortiVoice 7.2.0, FortiVoice 7.0.0 through 7.0.6, FortiVoice 6.4.0 through 6.4.10 allows a remote unauthenticated attacker to execute arbitrary code or commands via sending HTTP requests with specially crafted hash cookie.
Source: psirt@fortinet.com
NVD status: Analyzed
Products: fortimail, fortindr, fortirecorder, fortivoice, forticamera_firmware

Risk scores

CVSS 3.1

Type: Primary
Base score: 9.8
Impact score: 5.9
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity: CRITICAL

Known exploits

Data from CISA

Vulnerability name: Fortinet Multiple Products Stack-Based Buffer Overflow Vulnerability
Exploit added on: May 14, 2025
Exploit action due: Jun 4, 2025
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Weaknesses

psirt@fortinet.com: CWE-121
nvd@nist.gov: CWE-787

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:fortinet:fortimail:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "F05ACB93-42BC-43CD-845F-35FA9FE1D92D",
            "versionEndExcluding": "7.0.9",
            "versionStartIncluding": "7.0.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:fortinet:fortimail:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "8395970D-F937-4D1C-9FE1-90348F33FA94",
            "versionEndExcluding": "7.2.8",
            "versionStartIncluding": "7.2.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:fortinet:fortimail:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "3A40DE6A-D852-4B7E-BA67-B5DBBB3D427C",
            "versionEndExcluding": "7.4.5",
            "versionStartIncluding": "7.4.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:fortinet:fortimail:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "F2F1655C-A21F-4FD3-875C-4E1DD8A7E178",
            "versionEndExcluding": "7.6.3",
            "versionStartIncluding": "7.6.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:fortinet:fortindr:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "039768AE-7C53-48E2-ADEE-77AE304B3D36",
            "versionEndExcluding": "7.0.7",
            "versionStartIncluding": "7.0.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:fortinet:fortindr:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "25383BFB-4CBE-4577-8AB7-4259D03B5B6F",
            "versionEndExcluding": "7.2.5",
            "versionStartIncluding": "7.2.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:fortinet:fortindr:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "68F2B9B7-29FE-4CDD-8638-33CA947AB466",
            "versionEndExcluding": "7.4.8",
            "versionStartIncluding": "7.4.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:fortinet:fortindr:1.1.0:*:*:*:*:*:*:*",
            "matchCriteriaId": "0A64D6DA-FC2D-4411-9ADF-7103C0EA652E",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:fortinet:fortindr:1.2.0:*:*:*:*:*:*:*",
            "matchCriteriaId": "90B58E2B-7304-49FB-9454-ED9FFBCEE697",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:fortinet:fortindr:1.3.0:*:*:*:*:*:*:*",
            "matchCriteriaId": "9C0A1B68-65DC-4267-939A-216758809DC5",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:fortinet:fortindr:1.4.0:*:*:*:*:*:*:*",
            "matchCriteriaId": "EF813322-7AF8-4F9C-82D9-DBEF8888B97B",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:fortinet:fortindr:1.5.0:*:*:*:*:*:*:*",
            "matchCriteriaId": "86DD4A5F-260B-446D-8891-069A34D31760",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:fortinet:fortindr:7.1.0:*:*:*:*:*:*:*",
            "matchCriteriaId": "888692FD-3219-49D3-898C-F4EA84CCC6CF",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:fortinet:fortindr:7.1.1:*:*:*:*:*:*:*",
            "matchCriteriaId": "874D4928-620B-42FE-8B19-C4314C46739A",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:fortinet:fortindr:7.6.0:*:*:*:*:*:*:*",
            "matchCriteriaId": "9A1D8AE9-D9F9-402C-B8EB-58189200E0D6",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:fortinet:fortirecorder:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "A54116E5-DAA0-4D49-A2EE-FA9F9DF0D003",
            "versionEndExcluding": "6.4.6",
            "versionStartIncluding": "6.4.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:fortinet:fortirecorder:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "EF6B0F6E-6044-4F62-8AB5-A832A0554B9F",
            "versionEndExcluding": "7.0.6",
            "versionStartIncluding": "7.0.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:fortinet:fortirecorder:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "55A5E420-BCAF-4399-9223-A4398760CD87",
            "versionEndExcluding": "7.2.4",
            "versionStartIncluding": "7.2.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:fortinet:fortivoice:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "408D5EE5-B951-4022-A4DF-0295A04899E5",
            "versionEndExcluding": "6.4.11",
            "versionStartIncluding": "6.4.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:fortinet:fortivoice:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "58472BB4-2426-44B5-8D17-9C984EA567EB",
            "versionEndExcluding": "7.0.7",
            "versionStartIncluding": "7.0.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:fortinet:fortivoice:7.2.0:*:*:*:*:*:*:*",
            "matchCriteriaId": "76B48D4B-338A-4CEB-8712-6D880FF0F034",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ]
  },
  {
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:o:fortinet:forticamera_firmware:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "6DBA20DC-B0EE-4FB7-9607-99EDFC4AA459",
            "versionEndIncluding": "2.1.3",
            "versionStartIncluding": "2.0.0",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      },
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:h:fortinet:forticamera:-:*:*:*:*:*:*:*",
            "matchCriteriaId": "CFB863FD-5593-4620-8740-4EB692EA58E1",
            "vulnerable": false
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ],
    "operator": "AND"
  },
  {
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:o:fortinet:forticamera_firmware:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "A5FD90AB-29F2-40F1-8591-D046850906F7",
            "versionEndIncluding": "1.1.5",
            "versionStartIncluding": "1.1.0",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      },
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:h:fortinet:forticamera:-:*:*:*:*:*:*:*",
            "matchCriteriaId": "CFB863FD-5593-4620-8740-4EB692EA58E1",
            "vulnerable": false
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ],
    "operator": "AND"
  }
]

References

Sources include official advisories and independent security research.

Overview

Risk scores

CVSS 3.1

Known exploits

Weaknesses

Social media

Configurations

Related CVEs

References