Fortinet Patches CVE-2025-32756 Zero-Day RCE Flaw Exploited in FortiVoice Systems
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2025-32756 | Stack-based overflow RCE in Fortinet FortiMail, FortiVoice, FortiNDR, FortiFone CVE-2025-32756 is a stack-based buffer overflow (CWE-124) in Fortinet's FortiMail, FortiVoice, FortiNDR and FortiFone products that is reachable over the network and requires no authentication. An attacker triggers the flaw by sending crafted HTTP requests to the affected device's web-facing service. Successful exploitation yields arbitrary code or command execution on the appliance, giving the attacker control of the device and any traffic or data it handles (such as email or voice services). Organizations running these Fortinet appliances or phones are affected, particularly where the devices are reachable from the internet. The flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2025-05-14, confirming exploitation in the wild; no public proof-of-concept is known, ransomware use is unconfirmed, and EPSS puts its 30-day exploitation probability at about 30% (98th percentile). Do: Inventory your environment for FortiMail, FortiVoice, FortiNDR and FortiFone deployments and apply the patched releases specified in Fortinet's advisory for CVE-2025-32756. Until patched, restrict internet exposure of the affected devices' HTTP/HTTPS interfaces (limit admin and web access to trusted networks/VPN) per vendor mitigation guidance, and review device logs for signs of exploitation. Federal agencies must apply the required mitigations or discontinue use per BOD 22-01 deadlines. | 9.8 | 30% | KEV |
| largeLikely on the order of tens of thousands of deployed appliances/phones (estimate) |
Indicators of compromiseauto-extracted · verify before use · export allAll →
| Type | Indicator | Context |
|---|---|---|
| ipv4 | 156.236.76.90 | IP addresses - 198.105.127.124 43.228.217.173 43.228.217.82 156.236.76.90 218.187.69.244 218.187.69.59 Users of FortiVoice, FortiMail |
| ipv4 | 198.105.127.124 | ctor activity that originated from the below IP addresses - 198.105.127.124 43.228.217.173 43.228.217.82 156.236.76.90 218.187.69.244 2 |
| ipv4 | 218.187.69.244 | 198.105.127.124 43.228.217.173 43.228.217.82 156.236.76.90 218.187.69.244 218.187.69.59 Users of FortiVoice, FortiMail, FortiNDR, For |
| ipv4 | 218.187.69.59 | 4 43.228.217.173 43.228.217.82 156.236.76.90 218.187.69.244 218.187.69.59 Users of FortiVoice, FortiMail, FortiNDR, FortiRecorder, an |
| ipv4 | 43.228.217.173 | at originated from the below IP addresses - 198.105.127.124 43.228.217.173 43.228.217.82 156.236.76.90 218.187.69.244 218.187.69.59 Us |
| ipv4 | 43.228.217.82 | rom the below IP addresses - 198.105.127.124 43.228.217.173 43.228.217.82 156.236.76.90 218.187.69.244 218.187.69.59 Users of FortiVo |
Full article419 words · extracted from thehackernews.com · click to collapse
Ravie LakshmananMay 14, 2025Vulnerability / Network Security
Fortinet has patched a critical security flaw that it said has been exploited as a zero-day in attacks targeting FortiVoice enterprise phone systems.
The vulnerability, tracked as CVE-2025-32756, carries a CVSS score of 9.6 out of 10.0.
"A stack-based overflow vulnerability [CWE-121] in FortiVoice, FortiMail, FortiNDR, FortiRecorder, and FortiCamera may allow a remote unauthenticated attacker to execute arbitrary code or commands via crafted HTTP requests," the company said in an advisory.
The company said it observed the flaw being exploited in the wild on FortiVoice systems, but did not disclose the scale of the attacks and the identity of the threat actors behind them.
It further noted that the threat actor performed device network scans, erased system crash logs, and enabled fcgi debugging to log credentials from the system or SSH login attempts.
The issue affects the following products and versions -
- FortiCamera 1.1, 2.0 (Migrate to a fixed release)
- FortiCamera 2.1.x (Upgrade to 2.1.4 or above)
- FortiMail 7.0.x (Upgrade to 7.0.9 or above)
- FortiMail 7.2.x (Upgrade to 7.2.8 or above)
- FortiMail 7.4.x (Upgrade to 7.4.5 or above)
- FortiMail 7.6.x (Upgrade to 7.6.3 or above)
- FortiNDR 1.1, 1.2, 1.3, 1.4, 1.5, 7.1 (Migrate to a fixed release)
- FortiNDR 7.0.x (Upgrade to 7.0.7 or above)
- FortiNDR 7.2.x (Upgrade to 7.2.5 or above)
- FortiNDR 7.4.x (Upgrade to 7.4.8 or above)
- FortiNDR 7.6.x (Upgrade to 7.6.1 or above)
- FortiRecorder 6.4.x (Upgrade to 6.4.6 or above)
- FortiRecorder 7.0.x (Upgrade to 7.0.6 or above)
- FortiRecorder 7.2.x (Upgrade to 7.2.4 or above)
- FortiVoice 6.4.x (Upgrade to 6.4.11 or above)
- FortiVoice 7.0.x (Upgrade to 7.0.7 or above)
- FortiVoice 7.2.x (Upgrade to 7.2.1 or above)
Fortinet said the vulnerability was discovered by its product security team based on the threat actor activity that originated from the below IP addresses -
- 198.105.127.124
- 43.228.217.173
- 43.228.217.82
- 156.236.76.90
- 218.187.69.244
- 218.187.69.59
Users of FortiVoice, FortiMail, FortiNDR, FortiRecorder, and FortiCamera are recommended to apply the necessary fixes to secure their devices from active exploitation attempts. If immediate patching is not an option, it's advised to disable the HTTP/HTTPS administrative interface as a temporary workaround.
Update
In a technical analysis of CVE-2025-32756, Horizon3.ai said the vulnerability is a stack-based buffer overflow in the administrative API that can lead to unauthenticated remote code execution. However, it has opted to not punish a full-fledged proof-of-concept (PoC) exploit given that it's being weaponized in the wild.
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
Text extracted automatically; images, tables and formatting may be missing. Original: https://thehackernews.com/2025/05/fortinet-patches-cve-2025-32756-zero.html