U.S. CISA adds a Fortinet flaw to its Known Exploited Vulnerabilities catalog
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2025-32756 | Stack-based overflow RCE in Fortinet FortiMail, FortiVoice, FortiNDR, FortiFone CVE-2025-32756 is a stack-based buffer overflow (CWE-124) in Fortinet's FortiMail, FortiVoice, FortiNDR and FortiFone products that is reachable over the network and requires no authentication. An attacker triggers the flaw by sending crafted HTTP requests to the affected device's web-facing service. Successful exploitation yields arbitrary code or command execution on the appliance, giving the attacker control of the device and any traffic or data it handles (such as email or voice services). Organizations running these Fortinet appliances or phones are affected, particularly where the devices are reachable from the internet. The flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2025-05-14, confirming exploitation in the wild; no public proof-of-concept is known, ransomware use is unconfirmed, and EPSS puts its 30-day exploitation probability at about 30% (98th percentile). Do: Inventory your environment for FortiMail, FortiVoice, FortiNDR and FortiFone deployments and apply the patched releases specified in Fortinet's advisory for CVE-2025-32756. Until patched, restrict internet exposure of the affected devices' HTTP/HTTPS interfaces (limit admin and web access to trusted networks/VPN) per vendor mitigation guidance, and review device logs for signs of exploitation. Federal agencies must apply the required mitigations or discontinue use per BOD 22-01 deadlines. | 9.8 | 30% | KEV |
| largeLikely on the order of tens of thousands of deployed appliances/phones (estimate) |
Full article427 words · extracted from securityaffairs.com · click to collapse
U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds a Fortinet vulnerability to its Known Exploited Vulnerabilities catalog.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added Fortinet Multiple Products Stack-Based Buffer Overflow Vulnerability, tracked as CVE-2025-32756, to its Known Exploited Vulnerabilities (KEV) catalog.
This week, Fortinet released security updates to address a critical remote code execution zero-day, tracked as CVE-2025-32756, that was exploited in attacks targeting FortiVoice enterprise phone systems.
The vulnerability is a stack-based overflow issue that impacts in FortiVoice, FortiMail, FortiNDR, FortiRecorder and FortiCamera. A remote unauthenticated attackers can exploit the flaw to execute arbitrary code or commands via maliciously crafted HTTP requests.
“A stack-based overflow vulnerability [CWE-121] in FortiVoice, FortiMail, FortiNDR, FortiRecorder and FortiCamera may allow a remote unauthenticated attacker to execute arbitrary code or commands via crafted HTTP requests.” reads the advisory. “Fortinet has observed this to be exploited in the wild on FortiVoice.”
The company states that the threat actor that exploited the flaw scanned the network, erased crash logs, and enabled fcgi debugging to capture system or SSH login credentials.
The cybersecurity vendor observed attackers deploying malware on compromised servers, adding credential-stealing cron jobs, and using scripts to scan victim networks.
According to Indicators of Compromise shared by Fortinet, the attacks originated from half a dozen IP addresses, including 198.105.127[.]124, 43.228.217[.]173, 43.228.217[.]82, 156.236.76[.]90, 218.187.69[.]244, and 218.187.69[.]59.
Indicators of compromise also include the ‘fcgi debugging’ setting which was enabled on compromised systems.
“To verify if fcgi debugging is enabled on your system, use the following CLI command:
diag debug application fcgiIf the output shows “general to-file ENABLED”, it means fcgi debugging is enabled on your system:
fcgi debug level is 0x80041
general to-file ENABLEDThis is not a default setting, so unless you have enabled it in the past, this is potentially an Indicator of Compromise” continues the advisory.
Fortinet found attackers deploying malware, adding credential-stealing cron jobs, and using scripts to scan victim networks.
The company recommends disabling HTTP/HTTPS administrative interface as a workaround.
Fortinet Product Security Team discovered the flaw.
According to Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities, FCEB agencies have to address the identified vulnerabilities by the due date to protect their networks against attacks exploiting the flaws in the catalog.
Experts also recommend private organizations review the Catalog and address the vulnerabilities in their infrastructure.
CISA orders federal agencies to fix the vulnerabilities by June 4, 2025.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, CISA)
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/177862/hacking/u-s-cisa-adds-a-fortinet-flaw-to-its-known-exploited-vulnerabilities-catalog.html