CVE-2025-25249 CRITICAL

Published: 2026-01-13 | Last Modified: 2026-06-09 | Status: Modified

Description

A heap-based buffer overflow vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2.0 through 7.2.11, FortiOS 7.0.0 through 7.0.17, FortiOS 6.4 all versions, FortiSwitchManager 7.2.0 through 7.2.6, FortiSwitchManager 7.0.0 through 7.0.5 allows attacker to execute unauthorized code or commands via specially crafted packets

Additional Descriptions (1)

Una vulnerabilidad de desbordamiento de búfer basado en montículo en Fortinet FortiOS 7.6.0 a 7.6.3, FortiOS 7.4.0 a 7.4.8, FortiOS 7.2.0 a 7.2.11, FortiOS 7.0.0 a 7.0.17, FortiOS 6.4.0 a 6.4.16, FortiSwitchManager 7.2.0 a 7.2.6, FortiSwitchManager 7.0.0 a 7.0.5 permite al atacante ejecutar código o comandos no autorizados a través de paquetes especialmente diseñados.

CVSS Metrics

Base Score: 9.8 (CRITICAL)

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector	NETWORK
Attack Complexity	LOW
Privileges Required	NONE
User Interaction	NONE
Scope	UNCHANGED
Confidentiality Impact	HIGH
Integrity Impact	HIGH
Availability Impact	HIGH

Source: [email protected]

Type: Primary

Exploitability Score: 3.9

Impact Score: 5.9

Weaknesses

Source	Type	Description
[email protected]	Secondary	en CWE-122
[email protected]	Primary	en CWE-787

Affected Products

Vendor	Product	Version	Update	Type
fortinet	fortios	*	<built-in method update of dict object at 0x7d1e64470f40>	Operating System
fortinet	fortios	*	<built-in method update of dict object at 0x7d1ebce56400>	Operating System
fortinet	fortios	*	<built-in method update of dict object at 0x7d1ebce562c0>	Operating System
fortinet	fortios	*	<built-in method update of dict object at 0x7d1e64470440>	Operating System
fortinet	fortios	*	<built-in method update of dict object at 0x7d1e64b7eec0>	Operating System
fortinet	fortiswitchmanager	*	<built-in method update of dict object at 0x7d1e64b7ee80>	Application
fortinet	fortiswitchmanager	*	<built-in method update of dict object at 0x7d1e64470240>	Application
fortinet	fortisase	25.1.39	<built-in method update of dict object at 0x7d1e64b7d580>	Application
fortinet	fortisase	25.1.51	<built-in method update of dict object at 0x7d1ea0e24300>	Application

Affected Configurations

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:fortinet:fortios::::::::`
Yes	`cpe:2.3:o:fortinet:fortios::::::::`
Yes	`cpe:2.3:o:fortinet:fortios::::::::`
Yes	`cpe:2.3:o:fortinet:fortios::::::::`
Yes	`cpe:2.3:o:fortinet:fortios::::::::`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:a:fortinet:fortiswitchmanager::::::::`
Yes	`cpe:2.3:a:fortinet:fortiswitchmanager::::::::`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:a:fortinet:fortisase:25.1.39::::-:::`
Yes	`cpe:2.3:a:fortinet:fortisase:25.1.51::::-:::`

References

https://fortiguard.fortinet.com/psirt/FG-IR-25-084
Source: [email protected]

Vendor Advisory
https://cert-portal.siemens.com/productcert/html/ssa-864900.html
Source: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e