CVE Stalker: CVE-2025-25249

CVE Details

CVE-2025-25249 Fortinet Multiple Products Heap-based Buffer Overflow Vulnerability

Published: 2026-09-09 CVSS: 7.4 HIGH Product: Fortinet Multiple Products Due Date: 2026-09-12

Fortinet FortiOS, FortiSwitchManager, and FortiSASE contain a heap-based buffer overflow vulnerability that allows an attacker to execute unauthorized code or commands via specially crafted packets.

GitHub PoC

Warning: GitHub PoC repositories are unverified. Some may be fake or contain malware. Use caution and review code before running anything.

1337or420/FortiGate-FortiWeb-Multi-Exploit-Extractor • ⭐ 2 • 2026-05-14 • Conf: 85.0%
FortiGate & FortiWeb Multi-Exploit Extractor v3.0 Мощный сканер уязвимостей для FortiGate и FortiWeb, поддерживающий несколько известных CVE и извлечение учетных данных.

FIRST EPSS

EPSS estimates the probability of exploitation in the next 30 days. Higher values indicate higher likelihood of real-world exploitation.

Timeline

CVE Stalker KEV MITRE GitHub FIRST (EPSS)

MITRE

CVSS

Score: 7.4
Severity: HIGH
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:W/RC:C

SSVC

Exploitation: none
Automatable: no
Technical Impact: total

References

https://fortiguard.fortinet.com/psirt/FG-IR-25-084

Show Raw Data

Key	Remaining Key	Value
dataType		CVE_RECORD
dataVersion		5.2
cveMetadata >	cveId	CVE-2025-25249
cveMetadata >	assignerOrgId	6abe59d8-c742-4dff-8ce8-9b0ca1073da8
cveMetadata >	state	PUBLISHED
cveMetadata >	assignerShortName	fortinet
cveMetadata >	dateReserved	2025-02-05T13:31:18.866Z
cveMetadata >	datePublished	2026-01-13T16:32:35.662Z
cveMetadata >	dateUpdated	2026-08-11T12:22:44.887Z
containers >	cna > affected > 0 > vendor	Fortinet
containers >	cna > affected > 0 > product	FortiSwitchManager
containers >	cna > affected > 0 > cpes > 0	cpe:2.3:a:fortinet:fortiswitchmanager:7.2.5:::::::*
containers >	cna > affected > 0 > cpes > 1	cpe:2.3:a:fortinet:fortiswitchmanager:7.2.4:::::::*
containers >	cna > affected > 0 > cpes > 2	cpe:2.3:a:fortinet:fortiswitchmanager:7.2.3:::::::*
containers >	cna > affected > 0 > cpes > 3	cpe:2.3:a:fortinet:fortiswitchmanager:7.2.2:::::::*
containers >	cna > affected > 0 > defaultStatus	unaffected
containers >	cna > affected > 0 > versions > 0 > versionType	semver
containers >	cna > affected > 0 > versions > 0 > version	7.2.2
containers >	cna > affected > 0 > versions > 0 > lessThanOrEqual	7.2.5
containers >	cna > affected > 0 > versions > 0 > status	affected
containers >	cna > affected > 1 > vendor	Fortinet
containers >	cna > affected > 1 > product	FortiOS
containers >	cna > affected > 1 > cpes > 0	cpe:2.3:o:fortinet:fortios:7.6.2:::::::*
containers >	cna > affected > 1 > cpes > 1	cpe:2.3:o:fortinet:fortios:7.6.1:::::::*
containers >	cna > affected > 1 > cpes > 2	cpe:2.3:o:fortinet:fortios:7.6.0:::::::*
containers >	cna > affected > 1 > cpes > 3	cpe:2.3:o:fortinet:fortios:7.4.7:::::::*
containers >	cna > affected > 1 > cpes > 4	cpe:2.3:o:fortinet:fortios:7.4.6:::::::*
containers >	cna > affected > 1 > cpes > 5	cpe:2.3:o:fortinet:fortios:7.4.5:::::::*
containers >	cna > affected > 1 > cpes > 6	cpe:2.3:o:fortinet:fortios:7.4.4:::::::*
containers >	cna > affected > 1 > cpes > 7	cpe:2.3:o:fortinet:fortios:7.4.3:::::::*
containers >	cna > affected > 1 > cpes > 8	cpe:2.3:o:fortinet:fortios:7.4.2:::::::*
containers >	cna > affected > 1 > cpes > 9	cpe:2.3:o:fortinet:fortios:7.4.1:::::::*
containers >	cna > affected > 1 > cpes > 10	cpe:2.3:o:fortinet:fortios:7.4.0:::::::*
containers >	cna > affected > 1 > cpes > 11	cpe:2.3:o:fortinet:fortios:7.2.11:::::::*
containers >	cna > affected > 1 > cpes > 12	cpe:2.3:o:fortinet:fortios:7.2.10:::::::*
containers >	cna > affected > 1 > cpes > 13	cpe:2.3:o:fortinet:fortios:7.2.9:::::::*
containers >	cna > affected > 1 > cpes > 14	cpe:2.3:o:fortinet:fortios:7.2.8:::::::*
containers >	cna > affected > 1 > cpes > 15	cpe:2.3:o:fortinet:fortios:7.2.7:::::::*
containers >	cna > affected > 1 > cpes > 16	cpe:2.3:o:fortinet:fortios:7.2.6:::::::*
containers >	cna > affected > 1 > cpes > 17	cpe:2.3:o:fortinet:fortios:7.2.5:::::::*
containers >	cna > affected > 1 > cpes > 18	cpe:2.3:o:fortinet:fortios:7.2.4:::::::*
containers >	cna > affected > 1 > defaultStatus	unaffected
containers >	cna > affected > 1 > versions > 0 > versionType	semver
containers >	cna > affected > 1 > versions > 0 > version	7.6.0
containers >	cna > affected > 1 > versions > 0 > lessThanOrEqual	7.6.2
containers >	cna > affected > 1 > versions > 0 > status	affected
containers >	cna > affected > 1 > versions > 1 > versionType	semver
containers >	cna > affected > 1 > versions > 1 > version	7.4.0
containers >	cna > affected > 1 > versions > 1 > lessThanOrEqual	7.4.7
containers >	cna > affected > 1 > versions > 1 > status	affected
containers >	cna > affected > 1 > versions > 2 > versionType	semver
containers >	cna > affected > 1 > versions > 2 > version	7.2.4
containers >	cna > affected > 1 > versions > 2 > lessThanOrEqual	7.2.11
containers >	cna > affected > 1 > versions > 2 > status	affected
containers >	cna > descriptions > 0 > lang	en
containers >	cna > descriptions > 0 > value	A heap-based buffer overflow vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2.0 through 7.2.11, FortiOS 7.0.0 through 7.0.17, FortiOS 6.4 all versions, FortiSwitchManager 7.2.0 through 7.2.6, FortiSwitchManager 7.0.0 through 7.0.5 allows attacker to execute unauthorized code or commands via specially crafted packets
containers >	cna > providerMetadata > orgId	6abe59d8-c742-4dff-8ce8-9b0ca1073da8
containers >	cna > providerMetadata > shortName	fortinet
containers >	cna > providerMetadata > dateUpdated	2026-02-23T08:51:58.404Z
containers >	cna > problemTypes > 0 > descriptions > 0 > lang	en
containers >	cna > problemTypes > 0 > descriptions > 0 > cweId	CWE-122
containers >	cna > problemTypes > 0 > descriptions > 0 > description	Execute unauthorized code or commands
containers >	cna > problemTypes > 0 > descriptions > 0 > type	CWE
containers >	cna > metrics > 0 > format	CVSS
containers >	cna > metrics > 0 > cvssV3_1 > version	3.1
containers >	cna > metrics > 0 > cvssV3_1 > attackComplexity	HIGH
containers >	cna > metrics > 0 > cvssV3_1 > attackVector	NETWORK
containers >	cna > metrics > 0 > cvssV3_1 > availabilityImpact	HIGH
containers >	cna > metrics > 0 > cvssV3_1 > baseScore	7.4
containers >	cna > metrics > 0 > cvssV3_1 > baseSeverity	HIGH
containers >	cna > metrics > 0 > cvssV3_1 > confidentialityImpact	HIGH
containers >	cna > metrics > 0 > cvssV3_1 > integrityImpact	HIGH
containers >	cna > metrics > 0 > cvssV3_1 > privilegesRequired	NONE
containers >	cna > metrics > 0 > cvssV3_1 > scope	UNCHANGED
containers >	cna > metrics > 0 > cvssV3_1 > userInteraction	NONE
containers >	cna > metrics > 0 > cvssV3_1 > vectorString	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:W/RC:C
containers >	cna > solutions > 0 > lang	en
containers >	cna > solutions > 0 > value	Upgrade to FortiSwitchManager version 7.2.7 or above Upgrade to FortiSwitchManager version 7.0.6 or above Fortinet remediated this issue in FortiSASE version 25.2.c and hence customers do not need to perform any action. Fortinet remediated this issue in FortiSASE version 25.1.b and hence customers do not need to perform any action. Upgrade to upcoming FortiOS version 8.0.0 or above Upgrade to FortiOS version 7.6.4 or above Upgrade to FortiOS version 7.4.9 or above Upgrade to FortiOS version 7.2.12 or above Upgrade to FortiOS version 7.0.18 or above
containers >	cna > references > 0 > name	https://fortiguard.fortinet.com/psirt/FG-IR-25-084
containers >	cna > references > 0 > url	https://fortiguard.fortinet.com/psirt/FG-IR-25-084
containers >	adp > 0 > metrics > 0 > other > type	ssvc
containers >	adp > 0 > metrics > 0 > other > content > id	CVE-2025-25249
containers >	adp > 0 > metrics > 0 > other > content > role	CISA Coordinator
containers >	adp > 0 > metrics > 0 > other > content > options > 0 > Exploitation	none
containers >	adp > 0 > metrics > 0 > other > content > options > 1 > Automatable	no
containers >	adp > 0 > metrics > 0 > other > content > options > 2 > Technical Impact	total
containers >	adp > 0 > metrics > 0 > other > content > version	2.0.3
containers >	adp > 0 > metrics > 0 > other > content > timestamp	2026-01-14T04:57:25.533277Z
containers >	adp > 0 > title	CISA ADP Vulnrichment
containers >	adp > 0 > providerMetadata > orgId	134c704f-9b21-4f2e-91b3-4a467353bcc0
containers >	adp > 0 > providerMetadata > shortName	CISA-ADP
containers >	adp > 0 > providerMetadata > dateUpdated	2026-02-26T15:04:42.502Z
containers >	adp > 1 > x_adpType	supplier
containers >	adp > 1 > providerMetadata > orgId	0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
containers >	adp > 1 > providerMetadata > shortName	siemens-SADP
containers >	adp > 1 > providerMetadata > dateUpdated	2026-08-11T12:22:44.887Z
containers >	adp > 1 > affected > 0 > vendor	Siemens
containers >	adp > 1 > affected > 0 > product	RUGGEDCOM APE1808
containers >	adp > 1 > affected > 0 > versions > 0 > status	affected
containers >	adp > 1 > affected > 0 > versions > 0 > version	0
containers >	adp > 1 > affected > 0 > versions > 0 > lessThan	*
containers >	adp > 1 > affected > 0 > versions > 0 > versionType	custom
containers >	adp > 1 > affected > 0 > defaultStatus	unknown
containers >	adp > 1 > references > 0 > url	https://cert-portal.siemens.com/productcert/html/ssa-864900.html