IM
IronMonkey Threat Research

CVE-2025-25249 CRITICAL

Published: 2026-01-13 | Last Modified: 2026-10-07 | Status: Analyzed

Description

A heap-based buffer overflow vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2.0 through 7.2.11, FortiOS 7.0.0 through 7.0.17, FortiOS 6.4 all versions, FortiSwitchManager 7.2.0 through 7.2.6, FortiSwitchManager 7.0.0 through 7.0.5 allows attacker to execute unauthorized code or commands via specially crafted packets

Additional Descriptions (1)

Una vulnerabilidad de desbordamiento de búfer basado en montículo en Fortinet FortiOS 7.6.0 a 7.6.3, FortiOS 7.4.0 a 7.4.8, FortiOS 7.2.0 a 7.2.11, FortiOS 7.0.0 a 7.0.17, FortiOS 6.4.0 a 6.4.16, FortiSwitchManager 7.2.0 a 7.2.6, FortiSwitchManager 7.0.0 a 7.0.5 permite al atacante ejecutar código o comandos no autorizados a través de paquetes especialmente diseñados.

CVSS Metrics

Base Score: 9.8 (CRITICAL)

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack VectorNETWORK
Attack ComplexityLOW
Privileges RequiredNONE
User InteractionNONE
ScopeUNCHANGED
Confidentiality ImpactHIGH
Integrity ImpactHIGH
Availability ImpactHIGH

Source: [email protected]

Type: Primary

Exploitability Score: 3.9

Impact Score: 5.9

Weaknesses

Source Type Description
[email protected] Secondary
en CWE-122
[email protected] Primary
en CWE-787

Affected Products

Vendor Product Version Update Type
fortinet fortios * <built-in method update of dict object at 0x7fd384a86580> Operating System
fortinet fortios * <built-in method update of dict object at 0x7fd368d50580> Operating System
fortinet fortios * <built-in method update of dict object at 0x7fd3412b8f00> Operating System
fortinet fortios * <built-in method update of dict object at 0x7fd3848e13c0> Operating System
fortinet fortiswitchmanager * <built-in method update of dict object at 0x7fd384a87d80> Application
fortinet fortiswitchmanager * <built-in method update of dict object at 0x7fd384a87040> Application
fortinet fortisase 25.1.39 <built-in method update of dict object at 0x7fd2dbc80e00> Application
fortinet fortisase 25.1.51 <built-in method update of dict object at 0x7fd348bb92c0> Application
siemens ruggedcom_ape1808_firmware - <built-in method update of dict object at 0x7fd3412bb880> Operating System

Affected Configurations

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*
Yes cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*
Yes cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*
Yes cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:a:fortinet:fortiswitchmanager:*:*:*:*:*:*:*:*
Yes cpe:2.3:a:fortinet:fortiswitchmanager:*:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:a:fortinet:fortisase:25.1.39:*:*:*:-:*:*:*
Yes cpe:2.3:a:fortinet:fortisase:25.1.51:*:*:*:-:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:siemens:ruggedcom_ape1808_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:siemens:ruggedcom_ape1808:-:*:*:*:*:*:*:*

References