Vulnerability

CERT-In Vulnerability Note CIVN-2025-0103
Multiple Vulnerabilities in Fortinet Products

Original Issue Date:May 23, 2025

Severity Rating: CRITICAL

Software Affected

FortiCamera versions 2.1.0 through 2.1.3
FortiCamera 2.0 all versions
FortiCamera 1.1 all versions
FortiMail versions 7.6.0 through 7.6.2
FortiMail versions 7.4.0 through 7.4.4
FortiMail versions 7.2.0 through 7.2.7
FortiMail versions 7.0.0 through 7.0.8
FortiNDR version 7.6.0
FortiNDR versions 7.4.0 through 7.4.7
FortiNDR versions 7.2.0 through 7.2.4
FortiNDR versions 7.1 all versions
FortiNDR versions 7.0.0 through 7.0.6
FortiNDR 1.5 all versions
FortiNDR 1.4 all versions
FortiNDR 1.3 all versions
FortiNDR 1.2 all versions
FortiNDR 1.1 all versions
FortiRecorder versions 7.2.0 through 7.2.3
FortiRecorder versions 7.0.0 through 7.0.5
FortiRecorder versions 6.4.0 through 6.4.5
FortiVoice version 7.2.0
FortiVoice versions 7.0.0 through 7.0.6
FortiVoice versions 6.4.0 through 6.4.10
FortiClientMac versions 7.4.0 through 7.4.2
FortiClientMac 7.2 versions 7.2.0 to 7.2.8
FortiClientMac 7.0 all versions

Overview

Multiple Vulnerabilities have been reported in Fortinet products which could allow the attacker to execute remote code and gain elevated privileges on the targeted system.

Target Audience:
All organizations and individuals using Fortinet products.

Impact Assessment:
Disclosure of sensitive information and system compromise.

Risk Assessment:
High risk of system compromise and sensitive information disclosure.

Description

Fortinet is a global cybersecurity company that provides network security solutions, including firewalls, VPNs, and intrusion prevention systems.

Multiple vulnerabilities have been reported in Fortinet products, attributed to inadequate authorization mechanisms in XPC services and a stack-based buffer overflow issue. These vulnerabilities may be exploited by attackers through the use of specially crafted requests.

Successful exploitation of these vulnerabilities could allow the attacker to remotely execute code and gain elevated privileges on the targeted system.

Note: [CVE-2025-32756] is being exploited in the wild against FortiVoice instances.

Solution

Apply appropriate software updates or workarounds as mentioned in:
https://www.fortiguard.com/psirt/FG-IR-25-016

https://www.fortiguard.com/psirt/FG-IR-25-254

Vendor Information

Fortinet
https://fortiguard.fortinet.com/psirt

References

Fortinet
https://www.fortiguard.com/psirt/FG-IR-25-016
https://www.fortiguard.com/psirt/FG-IR-25-254

CVE Name
CVE-2025-25251
CVE-2025-32756

Disclaimer

The information provided herein is on "as is" basis, without warranty of any kind.

Contact Information

Email: info@cert-in.org.in
Phone: +91-11-22902657

Postal address

Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
Electronics Niketan
6, CGO Complex, Lodhi Road,
New Delhi - 110 003
India