CVE DatabaseCVE-2025-32756

Updated 2026-06-17한국어 권고문 →

CVE-2025-327569.8/CRITICALCISA KEVCWE-121CWE-787

Fortinet Multiple Products Stack-based Buffer Overflow Vulnerability (CVE-2025-32756) Security Advisory

⚡ Jump to Patch

Affected Vendors

fortinet

Affected Components

forticamera, fortimail, fortindr, fortirecorder, fortivoice

Published Date

2025-05-13

CVSS v3.1

9.8

CRITICAL

EPSS (30d)

30.9%

FIRST.org

CISA KEV

Exploited

NVD Source ↗

Executive & SecOps Summary

SECOPS ASSESSMENT

Affected Scope

Multiple Fortinet appliance product lines including FortiCamera, FortiMail, FortiNDR, FortiRecorder, and FortiVoice

Impact

Unauthenticated remote attackers can execute arbitrary code or commands with root privileges by sending crafted HTTP requests containing a malicious hash cookie

Mitigation

Immediately upgrade to the patched firmware versions provided by the vendor and restrict external access to management interfaces

Affected Products & Version Scope

FortiCamera (2.1.0 to 2.1.3, 2.0 all versions, 1.1 all versions), FortiMail (7.6.0 to 7.6.2, 7.4.0 to 7.4.4, 7.2.0 to 7.2.7, 7.0.0 to 7.0.8), FortiNDR (7.6.0, 7.4.0 to 7.4.7, 7.2.0 to 7.2.4, 7.0.0 to 7.0.6), FortiRecorder (7.2.0 to 7.2.3, 7.0.0 to 7.0.5, 6.4.0 to 6.4.5), FortiVoice (7.2.0, 7.0.0 to 7.0.6, 6.4.0 to 6.4.10)

Remediation & Live Workaround Commands

PATCH & WORKAROUND

1. Official Patch & Version Upgrade Commands

Apply the official firmware updates immediately. Below is an example of upgrading Fortinet appliance firmware via TFTP using the CLI:

bash

# Example CLI command to restore/upgrade firmware image via TFTP
# Note: Ensure you back up the configuration before proceeding.
execute restore image tftp FML_763_image.out 192.168.1.100

# Verify the system status and version after reboot
get system status

2. Temporary Workaround & Hardening Configuration

If patching cannot be applied immediately, restrict access to the administrative web interface using local firewall policies or access control lists (ACLs).

bash

# Example configuration to restrict HTTP/HTTPS access to trusted administrative subnets only
config system admin
    set admin-sport 8443
end
config system interface
    edit 'port1'
        set allowaccess ping ssh
    next
end

3. Log Audit & IoC Verification Commands

Administrators can inspect web server access logs for abnormally long cookie values or suspicious patterns associated with the 'hash' cookie.

bash

# Search for HTTP requests containing abnormally long hash cookies in the logs
grep -Ei 'cookie:.*hash=[a-zA-Z0-9+/=]{100,}' /var/log/nginx/access.log || echo 'No suspicious hash cookies found.'

Interactive SecOps Remediation Checklist

0/4 (0%)

Recommended Security Control & Mitigation Partner

NordLayer / Zero-Trust Network Access

Due to active exploitation in the wild, immediately upgrade all affected Fortinet appliances to the recommended secure versions.

Stop Exposing VPN Ports to the Internet — Switch to Zero-Trust Access

Eliminate public-facing VPN concentrators and firewall management ports with identity-first Zero-Trust Network Access.

90% Attack Surface Reduction · Hardware-Free

Explore Zero-Trust Network Access Plans

Technical Root Cause & Exploitation Mechanics

1. Vulnerability Overview & Root Cause

This vulnerability (CVE-2025-32756) is a critical stack-based buffer overflow [CWE-121] affecting multiple Fortinet products. The root cause lies in the HTTP daemon handling web management and API requests, which fails to properly validate the length of the 'hash' cookie header before copying it into a fixed-size stack buffer. This lack of boundary checking allows an attacker to overwrite the stack frame's return address, leading to arbitrary code execution.

2. Exploitation Mechanics & Attack Scenario

An unauthenticated remote attacker can exploit this vulnerability by sending a specially crafted HTTP request to the target device's web management port. The request includes an oversized payload within the 'hash' cookie. When the vulnerable parser processes this cookie, the stack buffer overflows, allowing the attacker to hijack the instruction pointer (EIP/RIP) and redirect execution flow to injected shellcode or system commands, bypassing authentication entirely.

3. Infrastructure & Business Impact

With a CVSS score of 9.8 and its inclusion in CISA's Known Exploited Vulnerabilities (KEV) catalog, this vulnerability poses an immediate threat to enterprise infrastructure. Successful exploitation allows complete compromise of critical appliances such as mail gateways (FortiMail), network detection systems (FortiNDR), and physical security systems (FortiCamera/FortiRecorder). This can serve as an entry point for lateral movement, data exfiltration, or ransomware deployment.

Official Vendor Advisories & References

NVD Original English Description

A stack-based buffer overflow vulnerability [CWE-121] vulnerability in Fortinet FortiCamera 2.1.0 through 2.1.3, FortiCamera 2.0 all versions, FortiCamera 1.1 all versions, FortiMail 7.6.0 through 7.6.2, FortiMail 7.4.0 through 7.4.4, FortiMail 7.2.0 through 7.2.7, FortiMail 7.0.0 through 7.0.8, FortiNDR 7.6.0, FortiNDR 7.4.0 through 7.4.7, FortiNDR 7.2.0 through 7.2.4, FortiNDR 7.0.0 through 7.0.6, FortiRecorder 7.2.0 through 7.2.3, FortiRecorder 7.0.0 through 7.0.5, FortiRecorder 6.4.0 through 6.4.5, FortiVoice 7.2.0, FortiVoice 7.0.0 through 7.0.6, FortiVoice 6.4.0 through 6.4.10 allows a remote unauthenticated attacker to execute arbitrary code or commands via sending HTTP requests with specially crafted hash cookie.

https://fortiguard.fortinet.com/psirt/FG-IR-25-254

Source: psirt@fortinet.com · Vendor Advisory

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-32756

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 · US Government Resource

Frequently Asked SecOps Questions (CVE-2025-32756)

FAQ

Q1. How critical is CVE-2025-32756 and is it actively exploited in the wild?

CVE-2025-32756 is rated CVSS 9.8 (CRITICAL) with a 30-day EPSS exploitation probability of 30.9%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.

Q2. Which vendors and products are affected by CVE-2025-32756?

Primary impacted vendors include fortinet across forticamera, fortimail, fortindr, fortirecorder, fortivoice. Scope summary: FortiCamera (2.1.0 to 2.1.3, 2.0 all versions, 1.1 all versions), FortiMail (7.6.0 to 7.6.2, 7.4.0 to 7.4.4, 7.2.0 to 7.2.7, 7.0.0 to 7.0.8), FortiNDR (7.6.0, 7.4.0 to 7.4.7, 7.2.0 to 7.2.4, 7.0.0 to 7.0.6), FortiRecorder (7.2.0 to 7.2.3, 7.0.0 to 7.0.5, 6.4.0 to 6.4.5), FortiVoice (7.2.0, 7.0.0 to 7.0.6, 6.4.0 to 6.4.10)

Q3. What temporary mitigations or workarounds exist for CVE-2025-32756 before patching?

[Mitigation] Immediately upgrade to the patched firmware versions provided by the vendor and restrict external access to management interfaces Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.

SECOPS WORKBENCH INTEGRATION