A severe security vulnerability, identified as CVE-2025-32756, has been discovered in several Fortinet network security products, including FortiVoice, FortiMail, FortiNDR, FortiRecorder, and FortiCamera. This vulnerability is critical because it can be exploited by remote attackers without the need for access credentials. If successfully exploited, an attacker could gain full control of the affected Fortinet devices, with potentially serious consequences such as security breaches, data theft, network disruption, or the use of the compromised device for further attacks. Organizations using these Fortinet products should treat this vulnerability with the highest priority.

Technical Summary

CVE-2025-32756 is a stack-based buffer overflow vulnerability (CWE-121) present in the HTTP request handling mechanism of several Fortinet products. Specifically, the flaw is located in the /remote/login path. An unauthenticated remote attacker can trigger this overflow by sending specially crafted HTTP requests, typically by manipulating the content or length of data in certain request components, such as cookies or parameters.

The overflow allows the attacker to overwrite critical data on the stack, including saved instruction pointers (such as the return address). By carefully controlling the overwritten data, an attacker can redirect the program’s execution flow. This is often achieved using Return-Oriented Programming (ROP) techniques, where existing code fragments (gadgets) in the compromised application’s memory are chained together to execute arbitrary commands.

A successfully executed exploit can grant the attacker code execution with the privileges of the affected Fortinet service, which may be elevated (e.g., root or system access depending on the product and service architecture). This exploit assumes an environment where protections such as ASLR (Address Space Layout Randomization) and stack canaries are absent, disabled, or bypassable, and where certain memory addresses (e.g., for ROP gadgets and library functions like system()) are known or reliably predictable. The exploit typically involves delivering a payload containing shellcode or a ROP chain that executes a command, such as writing a file to the filesystem for verification or establishing a reverse shell.

Recommendations

Given the critical nature of CVE-2025-32756 and the potential for unauthenticated remote code execution, immediate action is required:

1. Apply patches immediately: Prioritize the application of security patches and firmware updates released by Fortinet for all affected products (FortiVoice, FortiMail, FortiNDR, FortiRecorder, FortiCamera) as soon as they become available. Monitor Fortinet security advisories closely.
2. Restrict access (mitigation): If patches cannot be applied immediately, restrict network access to management interfaces and any vulnerable paths (e.g., /remote/login) of the affected Fortinet devices. Allow access only from trusted IP addresses and internal management networks. Avoid exposing these interfaces directly to the Internet if possible.
3. Network segmentation: Ensure that the affected devices are properly segmented within the network to limit the potential impact of a compromise.
4. Web Application Firewall (WAF): If a WAF is deployed in front of the Fortinet devices, consider creating custom rules to inspect and block overly long or malformed data in HTTP request components (such as specific cookies or parameters) directed at known vulnerable paths. However, this measure should be considered only a temporary mitigation and does not replace the application of patches.