Fortinet FortiOS and FortiSwitchManager Heap Buffer Overflow RCE (CVE-2025-25249)

Immediate firmware upgrade is the primary remediation path.

1. Firmware Updates

• Upgrade to FortiOS 7.6.4 or higher
• Upgrade to FortiOS 7.4.9 or higher
• Upgrade to FortiOS 7.2.12 or higher
• Upgrade to FortiOS 7.0.18 or higher
• Upgrade to FortiSwitchManager 7.2.7 or 7.0.6 or higher

2. Temporary Mitigations

If patching is delayed, implement the following:

• Disable SSL-VPN: If not strictly required, disable the SSL-VPN service to reduce the attack surface.
• Restrict Management Access: Use Local-In policies or Interface settings to restrict administrative access (HTTPS/SSH) to specific, trusted IP addresses.

config firewall local-in-policy
  edit 1
    set intf "wan1"
    set srcaddr "TRUSTED_IP_RANGE"
    set dstaddr "all"
    set action accept
    set service "HTTPS" "SSH"
  next
end

CVE-2025-25249 is a critical heap-based buffer overflow vulnerability (CWE-122) residing in the packet processing engine of FortiOS and FortiSwitchManager. By transmitting specially crafted network packets, an attacker can trigger memory corruption, allowing for unauthorized code execution without any prior authentication (CVSS 9.8). This vulnerability is currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, indicating active use by threat actors for initial access and lateral movement. The high EPSS score of 0.94 underscores the urgency, as automated exploitation tools are likely targeting exposed FortiGate instances globally.