Fortinet · Multiple Products
CVE-2025-32756
Fortinet Multiple Products Stack-Based Buffer Overflow Vulnerability
O que é
A stack-based buffer overflow vulnerability [CWE-121] vulnerability in Fortinet FortiCamera 2.1.0 through 2.1.3, FortiCamera 2.0 all versions, FortiCamera 1.1 all versions, FortiMail 7.6.0 through 7.6.2, FortiMail 7.4.0 through 7.4.4, FortiMail 7.2.0 through 7.2.7, FortiMail 7.0.0 through 7.0.8, FortiNDR 7.6.0, FortiNDR 7.4.0 through 7.4.7, FortiNDR 7.2.0 through 7.2.4, FortiNDR 7.0.0 through 7.0.6, FortiRecorder 7.2.0 through 7.2.3, FortiRecorder 7.0.0 through 7.0.5, FortiRecorder 6.4.0 through 6.4.5, FortiVoice 7.2.0, FortiVoice 7.0.0 through 7.0.6, FortiVoice 6.4.0 through 6.4.10 allows a remote unauthenticated attacker to execute arbitrary code or commands via sending HTTP requests with specially crafted hash cookie.
CISA: Fortinet FortiFone, FortiVoice, FortiNDR and FortiMail contain a stack-based overflow vulnerability that may allow a remote unauthenticated attacker to execute arbitrary code or commands via crafted HTTP requests.
O que fazer
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Prazo para as agências federais dos EUA: 4 de junho de 2025
- Adicionada à lista da CISA
- 14 de maio de 2025
- Publicada
- 13 de maio de 2025
- Gravidade
- Crítica 9,6 CVSS 3.1
- Chance de ataques nos próximos 30 dias (EPSS)
- 31% entre os 1,7% mais altos de todas as vulnerabilidades conhecidas
- Fraqueza
- CWE-124
- Mais detalhes
- NVD · CVE.org · CISA
Todas as referências (1)
Mais falhas exploradas de Fortinet
| Adicionado | Vulnerabilidade | Produto | Gravidade | Chance de ataque |
|---|---|---|---|---|
| 16 de out. de 2026 | Path Traversal | Multiple Products | Média 5,4 | 1,3% |
| 9 de set. de 2026 | Heap-based Buffer Overflow | Multiple Products | Alto 7,4 | 3,7% |
| 27 de jan. de 2026 | Authentication Bypass Using an Alternate Path or Channel | Multiple Products | Crítica 9,4 | 87% |
| 16 de dez. de 2025 | Improper Verification of Cryptographic Signature | Multiple Products | Crítica 9,1 | 68% |
| 9 de out. de 2024 | Format String | Multiple Products | Crítica 9,8 | 62% |
| 11 de out. de 2022 | Authentication Bypass | Multiple Products | Crítica 9,8 | >99,9% |
| 1 de out. de 2026 | Path Traversal | FortiMail | Crítica 9,8 | 4,6% |
| 27 de jul. de 2026 | Exposure of Sensitive Information to an Unauthorized Actor | FortiOS | Média 5,3 | 29% |
Fontes: Known Exploited Vulnerabilities (CISA, domínio público), CVE records (cve.org) e EPSS (FIRST). A chance de ataque é a estimativa EPSS de que alguém tente explorar a falha nos próximos 30 dias.