VulnSocial
← Back to blog

CVE-2025-25249 – Critical Fortinet FortiOS Heap-Based Buffer Overflow

CVE-2025-25249 is a Critical unauthenticated RCE vulnerability in Fortinet FortiOS and related products. Crafted network packets can trigger a heap-based buffer overflow, allowing unauthorized code or command execution; it is listed in CISA KEV because exploitation has been observed.

TL;DR

  • CVE-2025-25249 – Critical: Network-accessible, unauthenticated RCE through a heap-based buffer overflow.
  • CISA KEV: Added on 2026-09-09; federal remediation was due 2026-09-12.
  • FortiOS / FortiSwitchManager: Affected releases require urgent upgrade; all FortiOS 6.4 versions are in scope.
  • Immediate action: patch supported releases, restrict UDP/5246, and investigate internet-facing exposure.

Overview

The vulnerable cw_acd component is associated with CAPWAP over UDP/5246. Because exploitation is network-based and requires neither credentials nor user interaction, internet-facing FortiGate/FortiOS devices are the first triage target. Successful exploitation can enable configuration access, policy changes, persistence, and use of the appliance as a pivot point.

Technical details

Vulnerability mechanics

The issue is a heap-based buffer overflow in cw_acd, reached through CAPWAP UDP/5246. A specially crafted packet can cause an out-of-bounds heap write and lead to unauthorized code or command execution.

Severity and impact

Fortinet's CNA assigns CVSS 8.1 (High) with vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H; NIST assigns CVSS 9.8 (Critical) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The scores differ mainly in attack complexity, while both describe a network-reachable, unauthenticated, no-user-interaction flaw with high impact. The Critical NIST rating should drive emergency prioritization.

Fortinet cites CWE-122; NVD maps CWE-787. Successful exploitation can expose configuration and credentials, alter security policy, establish persistence, and support lateral movement; the C:H/I:H/A:H impact indicators reflect potential confidentiality, integrity, and availability loss.

Affected products

Primary FortiOS ranges include:

  • FortiOS 7.6.0 through 7.6.3; 7.4.0 through 7.4.8; 7.2.0 through 7.2.11; 7.0.0 through 7.0.17; and all FortiOS 6.4 versions.
  • FortiSwitchManager 7.2.0 through 7.2.6 and 7.0.0 through 7.0.5.
  • The CPE scope also includes FortiSASE 25.1.39 and 25.1.51, plus Siemens RuggedCom APE1808 hardware and firmware; confirm applicability against the relevant advisory.

Upgrade targets

FortiOS 7.6.x -> 7.6.4+
FortiOS 7.4.x -> 7.4.9+
FortiOS 7.2.x -> 7.2.12+
FortiOS 7.0.x -> 7.0.18+
FortiSwitchManager 7.2.x -> 7.2.7+
FortiSwitchManager 7.0.x -> 7.0.6+
FortiOS 6.4 -> follow the vendor advisory

For FortiOS 6.4, follow the vendor advisory's mitigation or upgrade path. For the full list of affected products and versions, see CVE page.

Threat activity and PivotC2

Security researchers reported a campaign targeting more than 30,000 IP addresses and identified 178 compromised devices. The target count is not the number of confirmed compromises.

PivotC2 is a custom Node.js RAT used for post-exploitation; reported capabilities include SOCKS5 tunneling, CIDR scanning, configuration harvesting, and credential decryption.

The supplied telemetry recorded 57 mentions over nine days, repeated active exploitation reports, and a peak of 14 on 2026-09-10. For key indicators, exploit activity over time, and detailed signal data, see VulnSocial CVE page. CISA KEV status confirms known exploitation, not universal compromise.

Actionable insights

Exposure triage

Inventory all internet-facing FortiOS, FortiGate, FortiSwitchManager, FortiSASE, and RuggedCom APE1808 assets. Identify UDP/5246 reachability, management paths, FortiOS 6.4 status, and high-value HA roles. Prioritize externally reachable devices and systems that can reach sensitive internal networks.

Detection priorities

  • Unexpected inbound traffic to CAPWAP UDP/5246, especially from untrusted sources or unusual patterns.
  • Outbound connections from the firewall immediately after suspicious inbound activity, including unknown destinations and sustained sessions.
  • Execution of Node.js or PivotC2-like artifacts, including scripts or binaries absent from the normal appliance image.
  • SOCKS5-style proxying, CIDR scans, configuration or credential access, administrative-session changes, and persistence.
# Generic hunt fields
cw_acd | CAPWAP | UDP/5246
node.js | PivotC2 | socks5
configuration | credential | persistence

Adapt these fields to the logging platform; strings are hunt leads, not proof of compromise.

Remediation & Mitigation

  1. Inventory and prioritize. Rank assets by internet exposure, UDP/5246 reachability, business criticality, and FortiOS 6.4 status.
  2. Apply the patch immediately. Upgrade supported releases to the fixed versions listed above, then confirm the running build after reboot or service restart.
  3. Use vendor mitigation while upgrading. Restrict or block UDP/5246 from untrusted networks, limit management access, segment CAPWAP traffic, and disable unused services. If no mitigation is available, discontinue use.
  4. Treat suspected compromise as an incident. Isolate affected devices, preserve logs, configuration, process, and network evidence, remove PivotC2, rotate administrative, VPN, API, and other secrets, and review policy, tunnel, and HA changes. Reimage if integrity cannot be established.
  5. Validate recovery. Close external UDP/5246 exposure, rescan the environment, monitor for recurrence or lateral movement, and verify consistent state across HA peers and dependent controllers.
  6. Meet compliance requirements. For federal systems, follow the CISA KEV required action: apply vendor mitigations, comply with BOD 26-04 and forensics triage requirements, evaluate internet exposure, apply applicable cloud guidance, and meet the 2026-09-12 deadline.

References

Bottom line

CVE-2025-25249 remains a Critical unauthenticated Fortinet FortiOS risk with known exploitation. Upgrade affected systems, restrict CAPWAP exposure, and investigate any internet-facing device rather than waiting for a confirmed alert. This is an urgent remediation and forensics task.

#CVE202525249 #Fortinet #FortiOS #FortiGate #Critical #RCE #HeapOverflow #CISAKEV #PivotC2