CVE-2025-32756 is a critical stack-based buffer overflow vulnerability affecting multiple Fortinet products, including FortiVoice, FortiMail, FortiNDR, FortiRecorder, and FortiCamera. This flaw allows unauthenticated remote attackers to execute arbitrary code or commands via crafted HTTP requests, posing a severe security risk.
1. Overview of CVE-2025-32756
Key Details
- Vulnerability Type: Stack-Based Buffer Overflow (CWE-121)
- CVSS Score: 9.6 (Critical)
- Affected Products:
- FortiVoice (Versions 7.2.0, 7.0.0 – 7.0.6, 6.4.0 – 6.4.10)
- FortiMail (Versions 7.6.0 – 7.6.2, 7.4.0 – 7.4.4, 7.2.0 – 7.2.7, 7.0.0 – 7.0.8)
- FortiNDR (Versions 7.6.0, 7.4.0 – 7.4.7, 7.2.0 – 7.2.4, 7.0.0 – 7.0.6)
- FortiRecorder (Versions 7.2.0 – 7.2.3, 7.0.0 – 7.0.5, 6.4.0 – 6.4.5)
- FortiCamera (Versions 2.1.0 – 2.1.3, 2.0 all versions, 1.1 all versions)
How It Works
- Attackers send specially crafted HTTP requests containing malicious hash cookies to vulnerable Fortinet devices.
- The flaw enables unauthenticated remote code execution (RCE), allowing attackers to gain full control over affected systems.
- Threat actors have actively exploited this vulnerability, targeting FortiVoice appliances in real-world attacks.
2. Exploitation & Attack Methods
Active Exploitation in the Wild
- Fortinet confirmed that CVE-2025-32756 has been exploited in real-world attacks, primarily targeting FortiVoice enterprise phone systems.
- Observed attack techniques include:
- Network scanning to identify vulnerable devices.
- Erasing system crash logs to cover tracks.
- Enabling FastCGI (fcgi) debugging to log credentials from SSH login attempts.
- Deploying malware on compromised devices.
Indicators of Compromise (IoCs)
- Threat actors launched attacks from multiple IP addresses, including:
- 198.105.127[.]124
- 43.228.217[.]173
- 156.236.76[.]90
- 218.187.69[.]244
3. Mitigation Strategies
A. Apply Security Updates Immediately
✅ Fortinet has released patches for affected products. Organizations must upgrade to the latest versions:
- FortiVoice 7.2 → Upgrade to 7.2.1 or later
- FortiMail 7.6 → Upgrade to 7.6.3 or later
- FortiNDR 7.6 → Upgrade to 7.6.1 or later
- FortiRecorder 7.2 → Upgrade to 7.2.4 or later
- FortiCamera 2.1 → Upgrade to 2.1.4 or later
B. Disable HTTP/HTTPS Administrative Interface
🔹 If immediate patching is not possible, disable the HTTP/HTTPS administrative interface to prevent remote exploitation.
C. Monitor for Exploitation Attempts
🔸 Deploy Intrusion Detection Systems (IDS) to flag suspicious activity.
🔸 Audit logs for unauthorized access attempts or unexpected system modifications.
4. Conclusion
CVE-2025-32756 is a critical vulnerability that has been actively exploited in the wild, primarily targeting FortiVoice appliances. Organizations using Fortinet products must apply patches immediately, disable vulnerable interfaces, and monitor for signs of compromise to mitigate risks.
🔗 Fortinet Security Advisory: Read more
