CVE-2025-25249
📛 CVE Title
CVE-2025-25249
Description
A heap-based buffer overflow vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2.0 through 7.2.11, FortiOS 7.0.0 through 7.0.17, FortiOS 6.4 all versions, FortiSwitchManager 7.2.0 through 7.2.6, FortiSwitchManager 7.0.0 through 7.0.5 allows attacker to execute unauthorized code or commands via specially crafted packets
Overview
- State
- PUBLISHED
- Assigner (CNA)
- fortinet
- CVSS severity
- HIGH
- CVSS score
- 7.4 / 10
- CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:W/RC:C- Effective score
- 7.4 / 10 HIGH source: CNA overview
- CWE(s)
-
CWE-122 - Reserved
- 2025-02-05
- Published
- 2026-01-13 17:32 UTC
- Last updated
- 2026-02-26 16:04 UTC
- Source
- https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/25xxx/CVE-2025-25249.json
- Linked Threat
- CVE-2025-25249 — Fortinet Multiple Products: Fortinet Multiple Products Heap-based Buffer Overflow Vulnerability
NVD triage scoring NVD CVE 2.0
Layer NVD adds on top of the CNA's CVE record — published / last-modified timestamps, exploitability / impact subscores, and the FIRST.org EPSS probability that this CVE will be exploited in the wild in the next 30 days.
- NVD published
- 2026-01-13 17:15:56 UTC
- NVD last modified
- 2026-06-17 09:00:33 UTC
- NVD CVSS v3.1
- 8.1 / 10 HIGH source: psirt@fortinet.com
- NVD CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H- Exploitability subscore
- 2.2 / 10
- Impact subscore
- 5.9 / 10
- EPSS score
- 0.0075 (probability of exploitation in next 30 days)
- EPSS percentile
- 51.20% vs all CVEs — higher = more likely to be exploited, as of 2026-07-30
NVD-assigned CWE(s):
CWE-122,
CWE-787
(differs from the CNA list above)
NVD / KEV / EPSS data refreshed 2026-07-30 22:44 UTC. Re-run the 🛰 Backfill from NVD button above to refresh.
European Union Vulnerability Database ENISA EUVD
ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.
- EUVD ID
-
EUVD-2026-2223 - Assigner
- fortinet
- Published
- Jan 13, 2026, 4:32:35 PM
- Updated
- Feb 26, 2026, 3:04:42 PM
- EUVD base score (CVSS 3.1)
-
7.4 / 10
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:W/RC:C - EUVD-reported EPSS
- 0.0200
- Vendors
- Fortinet
- Products
-
FortiOS (7.4.0 ≤7.4.7)FortiOS (7.2.4 ≤7.2.11)FortiOS (7.6.0 ≤7.6.2)FortiSwitchManager (7.2.2 ≤7.2.5)FortiSASE (25.1.a.2)
- Aliases
-
GHSA-mj8x-m8f5-x4w8
ENISA description: A heap-based buffer overflow vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2.0 through 7.2.11, FortiOS 7.0.0 through 7.0.17, FortiOS 6.4 all versions, FortiSwitchManager 7.2.0 through 7.2.6, FortiSwitchManager 7.0.0 through 7.0.5 allows attacker to execute unauthorized code or commands via specially crafted packets
EUVD references (1)
Affected products (2)
| Vendor | Product | Versions | Platforms |
|---|---|---|---|
| Fortinet | FortiSwitchManager |
7.2.2 (affected)
|
— |
| Fortinet | FortiOS |
7.6.0 (affected),
7.4.0 (affected),
7.2.4 (affected)
|
— |
Affected products — CPE 2.3 (4) NVD
NVD's normalized CPE 2.3 matchers, used by vendor tools (vulnerability scanners, asset managers) for automated detection. Compare with the CNA's free-text "Affected products" section above.
cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*cpe:2.3:a:fortinet:fortiswitchmanager:*:*:*:*:*:*:*:*cpe:2.3:a:fortinet:fortisase:25.1.39:*:*:*:-:*:*:*cpe:2.3:a:fortinet:fortisase:25.1.51:*:*:*:-:*:*:*
Vendor references (1)
References embedded in the original CVE record by the assigning CNA.
MITRE references (1) cveawg.mitre.org
Pulled from MITRE's CVE Services API by the 🛰 Backfill from MITRE button.
Web references (6)
DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.
- http://cwe.mitre.org/data/definitions/787.html rapid7:cwe.mitre.org
- https://attackerkb.com/topics/CVE-2025-25249 rapid7:attackerkb.com
- http://cwe.mitre.org/data/definitions/122.html rapid7:cwe.mitre.org
- https://www.cve.org/CVERecord?id=CVE-2025-25249 rapid7:www.cve.org
- https://www.fortiguard.com/psirt/FG-IR-25-084 rapid7:www.fortiguard.com
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-2223 rapid7:euvd.enisa.europa.eu
NVD-tagged references (2)
Reference list NVD curates from the CNA record, vendor advisories, and third-party reports. The tag chips below are NVD's analyst-assigned categories.
- https://fortiguard.fortinet.com/psirt/FG-IR-25-084 psirt@fortinet.com Vendor Advisory
- https://cert-portal.siemens.com/productcert/html/ssa-864900.html 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
Indicators (3)
IOCs linked to the auto-promoted Threat row.
| Type | Value | VirusTotal | Attached |
|---|---|---|---|
| cwe |
CWE-787
|
no local data | 2026-09-10 03:23 UTC |
| cwe |
CWE-122
|
no local data | 2026-09-10 03:23 UTC |
| cve |
CVE-2025-25249
|
no local data | 2026-09-10 03:23 UTC |
Remediations (19)
Remediations are stored against the linked Threat row; the list below is deduplicated across both pages.
-
CISA KEV
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. Due date: 2026-09-12 Known ransomware campaign use: Unknown
2026-09-10 03:23 UTC -
web:www.cvefind.com
CVE Find is a real-time vulnerability database indexing 384 736 security flaws ( CVE ) from MITRE, NVD, CISA KEV, CWE and CAPEC. 2784 new CVEs were published in the last 7 days. Data aggregated from: MITRE Corporation ( CVE , CWE, CAPEC), National Vulnerability Database - NIST (NVD), CISA Known Exploited Vulnerabilities (KEV), FIRST (EPSS).
2026-08-31 12:02 UTC -
web:www.microsoft.com
Help protect your computing environment by keeping up to date on Microsoft technical security notifications. Security Update Guide Notifications Microsoft's free Security Update Guide Notifications provide links to security-related software updates and notification of re-released security updates. These notifications are sent via email throughout the month as needed. You can choose the type of ...
2026-08-31 12:02 UTC -
web:www.nist.gov
NIST maintains the National Vulnerability Database (NVD), a repository of information on software and hardware flaws that can compromise computer security. This is a key piece of the nation's cybersecurity infrastructure.
2026-08-31 12:02 UTC -
web:nvd.nist.gov
NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed.
2026-08-31 12:02 UTC -
web:portal.msrc.microsoft.com
The Security Update Guide provides information on the latest Microsoft security updates, helping users understand and address potential vulnerabilities effectively.
2026-08-31 12:02 UTC -
web:www.sentinelone.com
CVE - 2025 -41249 is an authentication bypass vulnerability in Spring Framework. Learn about its impact, affected versions, and mitigation methods.
2026-08-31 12:02 UTC -
web:msrc.microsoft.com
The Microsoft Security Response Center (MSRC) investigates all reports of security vulnerabilities affecting Microsoft products and services, and provides the information here as part of the ongoing effort to help you manage security risks and help keep your systems protected.
2026-08-31 12:02 UTC -
web:digital.nhs.uk
Advisory addresses CVE-2025-25249 , a vulnerability which if exploited could allow a remote unauthenticated attacker to perform arbitrary code or command execution. The vulnerability affects FortiOS and FortiSwitch Manager.
2026-08-31 12:02 UTC -
web:app.opencve.io
The Spring Framework annotation detection mechanism may not correctly resolve annotations on methods within type hierarchies with a parameterized super type with unbounded generics. This can be an issue if such annotations are used for authorization decisions. Your application may be affected by this if you are using Spring Security's @EnableMethodSecurity feature. You are not affected by this ...
2026-05-22 12:43 UTC -
web:www.windowslatest.com
Windows 11 April 2026 update adds Narrator Copilot support, faster Settings, File Explorer fixes, and key security improvements.
2026-05-22 12:43 UTC -
web:cve.akaoma.com
Exploitability Analysis for CVE - 2025 -41249 With low attack complexity and no required privileges, CVE - 2025 -41249 is an easy target for cybercriminals. Organizations should prioritize immediate mitigation measures to prevent unauthorized access and data breaches. Understanding AC and PR
2026-05-22 12:43 UTC -
web:krebsonsecurity.com
Microsoft Corp. today issued security updates to fix more than 80 vulnerabilities in its Windows operating systems and software. There are no known "zero-day" or actively exploited vulnerabilities ...
2026-05-22 12:43 UTC -
web:nvd.nist.gov
An official website of the United States government Here's how you know
2026-05-22 12:43 UTC -
web:support.microsoft.com
Applies To SQL Server 2025 on Windows (all editions), SQL Server 2025 on Linux (all editions) Summary Improvements and fixes included in this update How to obtain and install the update How to obtain or download the latest cumulative update package for Linux More information File information Information about protection and security Summary This security update contains fixes and resolves ...
2026-05-22 12:43 UTC -
web:threatprotect.qualys.com
Tracked as CVE-2025-25249 , the vulnerability is a high-severity issue with a CVSS score of 7.3. The heap-based buffer overflow vulnerability exists in FortiOS and FortiSwitchManager cw_acd daemon. The vulnerability may allow a remote unauthenticated attacker to execute arbitrary code or commands via specifically crafted requests.
2026-05-22 12:43 UTC -
web:www.oracle.com
This Critical Patch Update contains 481 new security patches across the product families listed below. Please note that an MOS note summarizing the content of this Critical Patch Update and other Oracle Software Security Assurance activities is located at April 2026 Critical Patch Update: Executive Summary and Analysis.
2026-05-22 12:43 UTC -
web:www.rapid7.com
Microsoft is addressing 176 vulnerabilities this September 2025 Patch Tuesday, which is a lot. This includes a zero-day denial of service vulnerability in SQL Server.
2026-05-22 12:43 UTC -
web:www.tenable.com
The Spring Framework annotation detection mechanism may not correctly resolve annotations on methods within type hierarchies with a parameterized super type with unbounded generics. This can be an issue if such annotations are used for authorization decisions. Your application may be affected by this if you are using Spring Security's @EnableMethodSecurity feature. You are not affected by this ...
2026-05-22 12:43 UTC
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.
Raw JSON
The full cvelistV5 record. Download as CVE-2025-25249.json.
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-25249",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-01-14T04:57:25.533277Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-02-26T15:04:42.502Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:fortinet:fortiswitchmanager:7.2.5:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiswitchmanager:7.2.4:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiswitchmanager:7.2.3:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiswitchmanager:7.2.2:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "FortiSwitchManager",
"vendor": "Fortinet",
"versions": [
{
"lessThanOrEqual": "7.2.5",
"status": "affected",
"version": "7.2.2",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:o:fortinet:fortios:7.6.2:*:*:*:*:*:*:*",
"cpe:2.3:o:fortinet:fortios:7.6.1:*:*:*:*:*:*:*",
"cpe:2.3:o:fortinet:fortios:7.6.0:*:*:*:*:*:*:*",
"cpe:2.3:o:fortinet:fortios:7.4.7:*:*:*:*:*:*:*",
"cpe:2.3:o:fortinet:fortios:7.4.6:*:*:*:*:*:*:*",
"cpe:2.3:o:fortinet:fortios:7.4.5:*:*:*:*:*:*:*",
"cpe:2.3:o:fortinet:fortios:7.4.4:*:*:*:*:*:*:*",
"cpe:2.3:o:fortinet:fortios:7.4.3:*:*:*:*:*:*:*",
"cpe:2.3:o:fortinet:fortios:7.4.2:*:*:*:*:*:*:*",
"cpe:2.3:o:fortinet:fortios:7.4.1:*:*:*:*:*:*:*",
"cpe:2.3:o:fortinet:fortios:7.4.0:*:*:*:*:*:*:*",
"cpe:2.3:o:fortinet:fortios:7.2.11:*:*:*:*:*:*:*",
"cpe:2.3:o:fortinet:fortios:7.2.10:*:*:*:*:*:*:*",
"cpe:2.3:o:fortinet:fortios:7.2.9:*:*:*:*:*:*:*",
"cpe:2.3:o:fortinet:fortios:7.2.8:*:*:*:*:*:*:*",
"cpe:2.3:o:fortinet:fortios:7.2.7:*:*:*:*:*:*:*",
"cpe:2.3:o:fortinet:fortios:7.2.6:*:*:*:*:*:*:*",
"cpe:2.3:o:fortinet:fortios:7.2.5:*:*:*:*:*:*:*",
"cpe:2.3:o:fortinet:fortios:7.2.4:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "FortiOS",
"vendor": "Fortinet",
"versions": [
{
"lessThanOrEqual": "7.6.2",
"status": "affected",
"version": "7.6.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.4.7",
"status": "affected",
"version": "7.4.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.11",
"status": "affected",
"version": "7.2.4",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A heap-based buffer overflow vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2.0 through 7.2.11, FortiOS 7.0.0 through 7.0.17, FortiOS 6.4 all versions, FortiSwitchManager 7.2.0 through 7.2.6, FortiSwitchManager 7.0.0 through 7.0.5 allows attacker to execute unauthorized code or commands via specially crafted packets"
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:W/RC:C",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-122",
"description": "Execute unauthorized code or commands",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-02-23T08:51:58.404Z",
"orgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8",
"shortName": "fortinet"
},
"references": [
{
"name": "https://fortiguard.fortinet.com/psirt/FG-IR-25-084",
"url": "https://fortiguard.fortinet.com/psirt/FG-IR-25-084"
}
],
"solutions": [
{
"lang": "en",
"value": "Upgrade to FortiSwitchManager version 7.2.7 or above\nUpgrade to FortiSwitchManager version 7.0.6 or above\nFortinet remediated this issue in FortiSASE version 25.2.c and hence customers do not need to perform any action.\nFortinet remediated this issue in FortiSASE version 25.1.b and hence customers do not need to perform any action.\nUpgrade to upcoming FortiOS version 8.0.0 or above\nUpgrade to FortiOS version 7.6.4 or above\nUpgrade to FortiOS version 7.4.9 or above\nUpgrade to FortiOS version 7.2.12 or above\nUpgrade to FortiOS version 7.0.18 or above"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8",
"assignerShortName": "fortinet",
"cveId": "CVE-2025-25249",
"datePublished": "2026-01-13T16:32:35.662Z",
"dateReserved": "2025-02-05T13:31:18.866Z",
"dateUpdated": "2026-02-26T15:04:42.502Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}