Full Report
Fortinet released security updates to patch a critical remote code execution vulnerability exploited as a zero-day in attacks targeting FortiVoice enterprise phone systems. [...]
Analysis Summary
# Vulnerability: FortiVoice Critical Zero-Day Exploitation
## CVE Details
- CVE ID: CVE-2025-32756 (Inferred, as the text explicitly mentions a critical zero-day fixed by Fortinet related to FortiVoice exploitation, but does not explicitly state the CVE ID within the provided snippet. Using context to identify the primary vulnerability being discussed.)
- CVSS Score: Critical (Inferred based on description of "zero-day exploited")
- CWE: Not explicitly provided, but likely related to Improper Input Validation or Remote Code Execution.
## Affected Systems
- Products: FortiVoice
- Versions: Not explicitly listed in the summary provided.
- Configurations: Devices with the HTTP/HTTPS administrative interface enabled.
## Vulnerability Description
A critical vulnerability exists in FortiVoice systems that allows remote, unauthenticated attackers to execute arbitrary code or commands via maliciously crafted HTTP requests. This vulnerability has been actively exploited in the wild, with attackers observed performing network scans, deleting system crash logs to cover tracks, and toggling on 'fcgi debugging' to log credentials (including SSH login attempts).
## Exploitation
- Status: Exploited in the wild
- Complexity: Low (Implied by remote, unauthenticated execution and active exploitation)
- Attack Vector: Network
## Impact
- Confidentiality: High (Credential harvesting observed)
- Integrity: High (Arbitrary code execution observed)
- Availability: Potentially High (Code execution or system crashes intended for log deletion)
## Remediation
### Patches
- Specific patch versions are not detailed in this excerpt, but Fortinet has released security advisories and corresponding patches for this vulnerability.
### Workarounds
- Customers unable to apply updates immediately should **disable the HTTP/HTTPS administrative interface** on vulnerable devices.
## Detection
- **Indicators of Compromise (IOCs):**
- Presence of 'fcgi debugging' being enabled (not default).
- Hash analysis of deployed malware or dropped scripts.
- Network connections originating from known attacker IPs: 198.105.127\[.\]124, 43.228.217\[.\]173, 43.228.217\[.\]82, 156.236.76\[.\]90, 218.187.69\[.\]244, and 218.187.69\[.\]59.
- **Detection Methods and Tools:**
- Run the command `diag debug application fcgi` and check for output showing `"general to-file ENABLED"`.
- Monitor for unauthorized cron job additions designed for credential harvesting.
## References
- Vendor Advisory (Implied update required from Fortinet)
- [bleepingcomputer.com/news/security/fortinet-fixes-critical-zero-day-exploited-in-fortivoice-attacks/](https://www.bleepingcomputer.com/news/security/fortinet-fixes-critical-zero-day-exploited-in-fortivoice-attacks/)