CVE-2025-25249 - PatchNow

📋 Vulnerability Details

Data Source: CIRCL

Confidence: HIGH

Exploitation Method: DIRECT_NETWORK

CVE Published: 2026-01-13

Added to CISA KEV: 2026-09-09 239 DAYS BETWEEN CVE AND KEV

🎯 Recommendations:

CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs for suspicious cw_acd activity, check for the PivotC2 RAT (Node.js processes/backdoors), verify device configuration integrity, and inspect for unauthorized admin accounts or config changes.
IMMEDIATE: Upgrade FortiOS to 7.6.4+, 7.4.9+, 7.2.12+, or 7.0.18+; upgrade FortiSwitchManager to 7.2.7+ or 7.0.6+. FortiSASE customers are already remediated by vendor. Refer to FG-IR-25-084.
MITIGATION: Restrict access to the CAPWAP control plane so only authorized wireless APs/trusted networks can reach it; remove internet exposure of management and CAPWAP interfaces where possible.
MONITORING: Deploy IDS/IPS signatures for malformed CAPWAP packets, monitor for unexpected outbound C2 connections, and audit firmware/system image integrity given nation-state interest in network device persistence.
PATCH PRIORITY: EMERGENCY / P0 - actively exploited, unauthenticated RCE on perimeter devices.

🔍 Web Intelligence (Kagi · 2026-09-14)

Summary

CVE-2025-25249 is a high-severity heap-based buffer overflow vulnerability residing in the `cw_acd` daemon, a component responsible for the Control and Provisioning of Wireless Access Points (CAPWAP) protocol in FortiOS, FortiSwitchManager, and FortiSASE. This vulnerability is critical because it allows a remote attacker to execute unauthorized code or commands on affected devices by sending specially crafted packets, leading to full system compromise.

Exploitation

Active Exploitation: The vulnerability is actively exploited in the wild, and it has been added to the CISA Known Exploited Vulnerabilities (KEV) catalog.
Threat Actors/Campaigns: Threat actors have been using this flaw to deploy PivotC2, a custom remote access trojan (RAT) based on Node.js, on exposed FortiGate firewalls ^[1]^[3].
Proof-of-Concept: While specific exploit tools may be circulating among threat actors, public-facing reports focus on the successful deployment of custom malware following exploitation.
Attack Prerequisites: Exploitation occurs remotely via specially crafted packets; it does not typically require authentication or user interaction to trigger the overflow.

Affected Products & Patches

Affected Versions: The vulnerability impacts multiple versions of FortiOS (including 7.6.0–7.6.3, 7.4.0–7.4.8, and 7.2.0–7.2.11) as well as FortiSwitchManager and FortiSASE.
Patches/Fixes: Users are strongly advised to refer to the official Fortinet PSIRT advisory (FG-IR-25-084) for specific firmware versions that contain the necessary security patches ^[4].
Mitigations: Organizations should ensure that only authorized traffic is allowed to access the CAPWAP control plane and apply the latest vendor-supplied updates as soon as possible.

Impact

Capability: Successful exploitation grants an attacker the ability to execute arbitrary code or commands with the privileges of the `cw_acd` service, which effectively results in full device compromise ^[2].
Business Risk: For internet-facing deployments, this vulnerability poses a severe risk, as it allows attackers to establish persistent unauthorized access via backdoors like the PivotC2 RAT, facilitating credential theft, internal network pivoting, and long-term espionage within the victim's infrastructure ^[1]^[3].

Sources

CVE-2025-25249 Exploitation Delivers PivotC2, a FortiGate Post ...
CVE-2025-25249 Exploitation Delivers PivotC2, a FortiGate Post-Exploitation RAT One of the most common entry points for attackers is the exploitation of public-facing edge devices (such as VPNs, routers, and firewalls). ... CVE-2025-25249 (High – CVSSv3: 7.4) is a heap-based buffer overflow vulnerab…
CISA Warns of Fortinet Heap-based Buffer Overflow Flaw Exploited in Attacks
CVE-2025-25249 is a heap-based buffer overflow vulnerability. A heap overflow occurs when an application writes more data into a memory area than it was designed to hold. This can corrupt adjacent memory and potentially let an attacker alter program behavior, crash a device, or run malicious code wi…
Critical FortiGate Flaw Exploited to Deploy PivotC2 RAT and Steal ...
Threat actors are actively exploiting CVE-2025-25249, a critical heap-based buffer overflow in FortiOS and FortiSwitchManager’s cw_acd daemon, to compromise exposed FortiGate firewalls and deploy the PivotC2 remote access trojan (RAT).
FG-IR-25-084
verifying connection security. needs to review the security of your connection before proceeding.

🔴 CVE-2025-25249