Full Report
A suspected advanced threat actor has been observed exploiting a security flaw in Fortinet FortiOS to deliver a previously unreported memory-resident ARM64 malware known as PEERSTITCH. The attack involves the exploitation of CVE-2025-61624 (CVSS score: 5.4), a path traversal flaw in the command line interpreter of FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager that could allow a
Analysis Summary
# Vulnerability: Fortinet FortiOS Path Traversal (CVE-2025-61624) Exploited to Deliver PEERSTITCH Malware
*Note: The source article excerpt is truncated. Fields marked "Not stated" were not in the provided text and should be verified against the Fortinet PSIRT advisory before action.*
## CVE Details
- CVE ID: CVE-2025-61624
- CVSS Score: 5.4 (Medium)
- CWE: Not stated. The description ("path traversal") suggests CWE-22 (Improper Limitation of a Pathname to a Restricted Directory), but this is inferred, not confirmed.
## Affected Systems
- Products: FortiOS, FortiPAM, FortiProxy, FortiSwitchManager
- Versions: Not stated in the excerpt
- Configurations: Not stated in the excerpt
## Vulnerability Description
CVE-2025-61624 is a path traversal flaw in the command line interpreter (CLI) of several Fortinet products. Path traversal flaws let an attacker use crafted input (such as `../` sequences) to reach files or directories outside the intended path. The excerpt does not say what the traversal allows the attacker to read or write, or what privileges are required to trigger it.
## Exploitation
- Status: Exploited in the wild. A suspected advanced threat actor was observed using this flaw to deliver a previously unreported, memory-resident ARM64 malware family, PEERSTITCH.
- Complexity: Not stated
- Attack Vector: Not stated. The excerpt does not say whether authentication is required or whether the attack is remote.
- PoC availability: Not stated
## Impact
- Confidentiality: Not stated. Path traversal commonly exposes file contents, but the article does not confirm this.
- Integrity: Not stated. Depends on whether the traversal permits writes or file execution.
- Availability: Not stated
- Note: The CVSS score of 5.4 indicates a limited assessed impact, yet the flaw was used to deliver memory-resident malware. Treat the CVSS score as a baseline, not a measure of real-world risk in this campaign.
## Remediation
### Patches
- Not stated in the excerpt. Check the Fortinet PSIRT advisory for the fixed versions of FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager.
### Workarounds
- Not stated in the excerpt. As general practice, restrict administrative and CLI access to trusted management networks, limit administrator accounts, and disable remote management interfaces that do not need to be exposed.
## Detection
- Indicators of compromise: Not provided in the excerpt. Obtain the full article or vendor/threat intelligence reports for IOCs, including PEERSTITCH file hashes, network indicators, and any suspicious CLI activity.
- Detection methods:
- Review FortiOS CLI and administrative logs for unusual path-like input, especially directory traversal sequences (`../`, encoded variants such as `%2e%2e%2f`).
- Hunt for memory-resident ARM64 payloads on FortiGate and related appliances, since memory-only malware may leave few disk artifacts. Consider memory forensics or a device reboot followed by log review.
- Look for unexpected configuration changes, new administrator accounts, or outbound connections from the appliances.
## References
- Fortinet PSIRT advisory for CVE-2025-61624: [obtain from fortiguard.com/psirt; not provided in excerpt]
- Full source article: [not provided in excerpt]
- Refer to MITRE CVE record for CVE-2025-61624 for the official description and CWE mapping.