CVE-2025-32756

An attacker sends a specially crafted HTTP request containing a maliciously constructed hash cookie value. Improper handling of this value causes a stack-based buffer overflow (CWE-121 / CWE-787), which enables overwriting of process memory areas. The attack does not require any authentication or user interaction — network access to the vulnerable HTTP interface is sufficient.

Successful exploitation of the vulnerability allows an attacker to execute arbitrary code or system commands with the privileges of the vulnerable process, which in practice means complete takeover of the device.

Immediately apply patches available from the manufacturer in accordance with the official Fortinet security advisory (FG-IR-25-254) available at https://fortiguard.fortinet.com/psirt/FG-IR-25-254. Until the patch is implemented, consider restricting access to HTTP interfaces of vulnerable devices to trusted IP addresses only and increase monitoring of network traffic.

FortiCamera 1.1 (all versions), FortiCamera 2.0 (all versions), FortiCamera 2.1.0–2.1.3; FortiMail 7.0.0–7.0.8, 7.2.0–7.2.7, 7.4.0–7.4.4, 7.6.0–7.6.2; FortiNDR 7.0.0–7.0.6, 7.2.0–7.2.4, 7.4.0–7.4.7, 7.6.0; FortiRecorder 6.4.0–6.4.5, 7.0.0–7.0.5, 7.2.0–7.2.3; FortiVoice 6.4.0–6.4.10, 7.0.0–7.0.6, 7.2.0

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Fortinet FortiFone, FortiVoice, FortiNDR and FortiMail contain a stack-based overflow vulnerability that may allow a remote unauthenticated attacker to execute arbitrary code or commands via crafted HTTP requests.