Fortinet Releases Multiple Security Advisories
The security advisories address two critical vulnerabilities, of which one is reported as exploited
Summary
The security advisories address two critical vulnerabilities, of which one is reported as exploited
Affected platforms
The following platforms are known to be affected:
Threat details
Exploitation of CVE-2025-32756
Fortinet has observed active exploitation of CVE-2025-32756 in the wild on FortiVoice. The NHS England National CSOC assesses further exploitation as likely.
Introduction
Fortinet has released security advisories to two critical vulnerabilities.
The security advisories address one critical vulnerability in in FortiOS, FortiProxy and FortiSwitchManager, and an exploited vulnerability in FortiVoice, FortiMail, FortiNDR, FortiRecorder and FortiCamera.
Vulnerability Details
- CVE-2025-32756 is a 'stack-based buffer overflow' vulnerability with a CVSSv3 score of 9.6. Successful exploitation could allow a remote unauthenticated attacker to execute arbitrary code or commands via crafted HTTP requests.
- CVE-2025-22252 is an 'authentication for critical function' vulnerability with a CVSSv3 score of 9.0 in FortiOS, FortiProxy, and FortiSwitchManager products that are configured to use TACACS+ with ASCII authentication. Successful exploitation could allow an attacker with limited privileges to bypass authentication and gain administrator access to the device.
Note: CVE-2025-22252 is limited to configurations where ASCII authentication is used. PAP, MSCHAP, and CHAP configurations are not impacted.
Remediation advice
Affected organisations are encouraged to review Fortinet's Security Advisories and apply the relevant updates as soon as practicable. These advisories are detailed below for clarity.
Remediation steps
| Type | Step |
|---|---|
| Patch |
FG-IR-24-472 | FortiOS, FortiProxy and FortiSwitchManager https://www.fortiguard.com/psirt/FG-IR-24-472 |
| Patch |
FG-IR-25-254 | FortiVoice, FortiMail, FortiNDR, FortiRecorder and FortiCamera https://fortiguard.fortinet.com/psirt/FG-IR-25-254 |
Definitive source of threat updates
CVE Vulnerabilities
Last edited: 14 May 2025 3:45 pm