Pierluigi Paganini
May 15, 2025
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added Fortinet Multiple Products Stack-Based Buffer Overflow Vulnerability, tracked as CVE-2025-32756, to its Known Exploited Vulnerabilities (KEV) catalog.
This week, Fortinet released security updates to address a critical remote code execution zero-day, tracked as CVE-2025-32756, that was exploited in attacks targeting FortiVoice enterprise phone systems.
The vulnerability is a stack-based overflow issue that impacts in FortiVoice, FortiMail, FortiNDR, FortiRecorder and FortiCamera. A remote unauthenticated attackers can exploit the flaw to execute arbitrary code or commands via maliciously crafted HTTP requests.
“A stack-based overflow vulnerability [CWE-121] in FortiVoice, FortiMail, FortiNDR, FortiRecorder and FortiCamera may allow a remote unauthenticated attacker to execute arbitrary code or commands via crafted HTTP requests.” reads the advisory. “Fortinet has observed this to be exploited in the wild on FortiVoice.”
The company states that the threat actor that exploited the flaw scanned the network, erased crash logs, and enabled fcgi debugging to capture system or SSH login credentials.
The cybersecurity vendor observed attackers deploying malware on compromised servers, adding credential-stealing cron jobs, and using scripts to scan victim networks.
According to Indicators of Compromise shared by Fortinet, the attacks originated from half a dozen IP addresses, including 198.105.127[.]124, 43.228.217[.]173, 43.228.217[.]82, 156.236.76[.]90, 218.187.69[.]244, and 218.187.69[.]59.
Indicators of compromise also include the ‘fcgi debugging’ setting which was enabled on compromised systems.
“To verify if fcgi debugging is enabled on your system, use the following CLI command:
diag debug application fcgiIf the output shows “general to-file ENABLED”, it means fcgi debugging is enabled on your system:
fcgi debug level is 0x80041
general to-file ENABLEDThis is not a default setting, so unless you have enabled it in the past, this is potentially an Indicator of Compromise” continues the advisory.
Fortinet found attackers deploying malware, adding credential-stealing cron jobs, and using scripts to scan victim networks.
The company recommends disabling HTTP/HTTPS administrative interface as a workaround.
Fortinet Product Security Team discovered the flaw.
According to Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities, FCEB agencies have to address the identified vulnerabilities by the due date to protect their networks against attacks exploiting the flaws in the catalog.
Experts also recommend private organizations review the Catalog and address the vulnerabilities in their infrastructure.
CISA orders federal agencies to fix the vulnerabilities by June 4, 2025.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, CISA)
