Fortinet has disclosed a critical vulnerability (CVE-2025-32756) affecting multiple products in its security portfolio, with confirmed exploitation targeting FortiVoice systems.
The vulnerability, a stack-based buffer overflow, carries a CVSS score of 9.6. It allows unauthenticated remote attackers to execute arbitrary code or commands via specially crafted HTTP requests, potentially giving them full control over the affected devices.
Affected Products and Immediate Action
The flaw impacts FortiVoice, FortiMail, FortiNDR, FortiRecorder, and FortiCamera products across several versions. The vulnerability was discovered after active exploitation was observed in FortiVoice deployments.
Fortinet released security patches on May 13, 2025, addressing the vulnerability in affected products. Customers are urged to update to the latest patched versions immediately. If updates cannot be applied right away, Fortinet recommends disabling HTTP/HTTPS administrative interfaces as a temporary workaround.
Attack Patterns and Indicators of Compromise
Fortinet has documented several attack behaviors, including:
- Network reconnaissance
- Erasure of system crash logs to conceal activities
- Enabling FCGI debugging to capture credentials or log SSH login attempts
Researchers have identified multiple indicators of compromise (IoCs) linked to these attacks, such as suspicious log entries and unauthorized file modifications. Six IP addresses, including 198.105.127.124 and 218.187.69.244, have been connected to the attack.
Previous Vulnerabilities and Ongoing Threats
This attack follows a pattern of vulnerabilities in Fortinet products. Earlier in 2025, a different critical flaw (CVE-2024-55591) was exploited in the wild, and in late 2022, another vulnerability (CVE-2022-40684) was used by cyber-espionage groups.
Security experts stress that network security devices like FortiVoice are high-value targets due to their access to sensitive communications. Organizations using affected Fortinet products should prioritize addressing this vulnerability.
