Full Report
Fortinet and Ivanti published advisories on the same day revealing that attackers are exploiting new zero days, one of which is rated critical
Analysis Summary
Based on the provided article snippet, here is the summary focusing on the identified Fortinet vulnerability:
# Vulnerability: Fortinet Stack-Based Overflow Leading to Remote Code Execution
## CVE Details
- CVE ID: CVE-2025-32756
- CVSS Score: 9.6 (Critical)
- CWE: Stack-based overflow (Inferred from description)
## Affected Systems
- Products: FortiVoice, FortiMail, FortiNDR, FortiRecorder, and FortiCamera.
- Versions: Not specified in the provided text.
- Configurations: Vulnerable upon exposure to crafted HTTP requests.
## Vulnerability Description
The vulnerability is a stack-based overflow flaw in certain Fortinet products. A remote, unauthenticated attacker can exploit this vulnerability by sending specially crafted HTTP requests, which can lead to the execution of arbitrary code or commands on the affected device.
## Exploitation
- Status: Exploited in the wild
- Complexity: Not explicitly stated, but remote, unauthenticated RCE typically suggests Low to Medium complexity.
- Attack Vector: Network (via crafted HTTP requests)
## Impact
The following malicious activities were observed in the wild exploitation on FortiVoice:
- Confidentiality: Potential compromise due to ability to log credentials (SSH login attempts).
- Integrity: Potential for system alteration (e.g., erasing system crashlogs).
- Availability: Potential for system disruption or takeover.
**Specific Observed Actions:**
* Scan the device network
* Erase system crashlogs
* Enable `fcgi` debugging to log credentials from the system or SSH login attempts.
## Remediation
### Patches
- Fortinet has released a patch. Customers are urged to upgrade their tools to apply the fix (Refer to Fortinet advisory FG-IR-25-254).
### Workarounds
* **Checking `fcgi` Debugging Status:** Customers should use the CLI command `diag debug application fcgi`. If the output shows “general to-file ENABLED”, the debugging feature is active and should likely be disabled unless necessary.
* **Monitoring/Detection:** Use provided IOCs (logs and IP addresses) to check for signs of exploitation.
## Detection
- **Indicators of Compromise (IOC):** Fortinet provided a list of logs and IP addresses to aid detection.
- **Detection Methods and Tools:** Monitor for evidence of `fcgi` debugging being enabled (`diag debug application fcgi` outputting “general to-file ENABLED”) and look for unusual network scanning or log manipulation.
## References
- Vendor Advisory: fortiguard.fortinet.com/psirt/FG-IR-25-254 (Defanged)
- News Source: infosecurity-magazine.com/news/fortinet-ivanti-zero-days/ (Defanged - The main article link provided in the context)