Skip to content
Fencer Vulns
critical 9.8

CVE-2025-32756 kev in the critical feed json

A stack-based buffer overflow vulnerability [CWE-121] vulnerability in Fortinet FortiCamera 2.1.0 through 2.1.3, FortiCamera 2.0 all versio…

published 2025-05-13 17 mo ago modified 2026-06-17 4 mo ago also EUVD-2025-14705

cvss
9.8
version 3.1, CNA
cisa kev
Exploited
added 2025-05-14
epss
30.9%
EPSS 30.9% chance of exploitation in 30 days, percentile 98%
public exploits
0
none known

Summary

A stack-based buffer overflow vulnerability [CWE-121] vulnerability in Fortinet FortiCamera 2.1.0 through 2.1.3, FortiCamera 2.0 all versions, FortiCamera 1.1 all versions, FortiMail 7.6.0 through 7.6.2, FortiMail 7.4.0 through 7.4.4, FortiMail 7.2.0 through 7.2.7, FortiMail 7.0.0 through 7.0.8, FortiNDR 7.6.0, FortiNDR 7.4.0 through 7.4.7, FortiNDR 7.2.0 through 7.2.4, FortiNDR 7.0.0 through 7.0.6, FortiRecorder 7.2.0 through 7.2.3, FortiRecorder 7.0.0 through 7.0.5, FortiRecorder 6.4.0 through 6.4.5, FortiVoice 7.2.0, FortiVoice 7.0.0 through 7.0.6, FortiVoice 6.4.0 through 6.4.10 allows a remote unauthenticated attacker to execute arbitrary code or commands via sending HTTP requests with specially crafted hash cookie.

Patch / fix

cisa required action Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

  • fortinet fortimail 7.0.9, 7.2.8, 7.4.5, 7.6.3
  • fortinet fortindr 7.0.7, 7.2.5, 7.4.8
  • fortinet fortirecorder 6.4.6, 7.0.6, 7.2.4
  • fortinet fortivoice 6.4.11, 7.0.7

Timeline

  1. Published
  2. Added to CISA KEV
  3. CISA SSVC: exploitation active
  4. CISA patch deadline

Known exploited

Added
17 mo ago
Patch by
2025-06-04 (17 mo ago)
Ransomware
Not known
Required action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Vendor, product
Fortinet, Multiple Products
CISA name
Fortinet Multiple Products Stack-Based Buffer Overflow Vulnerability

ATT&CK techniques

How it is exploited and what it leads to, in MITRE ATT&CK terms.

  • T1133 External Remote Services exploitation
  • T1059 Command and Scripting Interpreter primary impact
  • T1003 OS Credential Dumping secondary impact
  • T1041 Exfiltration Over C2 Channel secondary impact
  • T1046 Network Service Discovery secondary impact
  • T1070.004 File Deletion secondary impact
  • T1608.001 Upload Malware secondary impact

kev release 2025-07-28, att&ck v16.1. KEV to ATT&CK mappings by the MITRE Center for Threat-Informed Defense (Mappings Explorer, Apache-2.0). © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. Terms of use

CISA SSVC

Exploitation
Active, exploited in the wild
Automatable
yes
Technical impact
total
Assessed
17 mo ago

Exploit prediction

30.94% chance of exploitation in the next 30 days, higher than 98% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 9.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:X/RC:C
CNA 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

  • Fortinet FortiNDR
  • Fortinet FortiCamera
  • Fortinet FortiRecorder
  • Fortinet FortiVoice
  • Fortinet FortiMail

Classification

Weakness
Technology feeds

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.