CVE-2025-25249: 
FortiOS vulnerability analysis and mitigation

CVE-2025-25249 is a heap-based buffer overflow vulnerability in the cw_acd daemon of Fortinet FortiOS and FortiSwitchManager that allows a remote unauthenticated attacker to execute arbitrary code or commands via specially crafted packets. It was disclosed on January 13, 2026, and affects FortiOS 6.4 (all versions), 7.0.0–7.0.17, 7.2.0–7.2.11, 7.4.0–7.4.8, and 7.6.0–7.6.3; FortiSwitchManager 7.0.0–7.0.5 and 7.2.0–7.2.6; and FortiSASE versions 25.1.a.2 and 25.2.b. NVD assigns a CVSS v3.1 base score of 9.8 (Critical), while Fortinet's own CNA scoring is 8.1 (High), reflecting the mitigating effect of security controls such as ASLR and PIE (FortiGuard Advisory, NVD).

The vulnerability is classified as CWE-122 (Heap-based Buffer Overflow) and CWE-787 (Out-of-bounds Write), rooted in insufficient bounds checking in the cw_acd (CAPWAP access controller daemon) within FortiOS and FortiSwitchManager (FortiGuard Advisory). An attacker can trigger the overflow by sending specially crafted network packets to the CAPWAP control port (UDP 5246–5249) on interfaces where the "fabric" access service is enabled, requiring no authentication or user interaction. Fortinet notes that the presence of ASLR and PIE security controls considerably raises the complexity and preparation effort required for successful exploitation, which is reflected in the vendor's lower CVSS score compared to NVD's assessment (FortiGuard Advisory). No public proof-of-concept exploit code has been identified as of the time of reporting (Feedly).

Successful exploitation allows a remote, unauthenticated attacker to execute arbitrary code or commands on the affected device, resulting in complete system compromise with high confidentiality, integrity, and availability impact. Affected assets include widely deployed Fortinet network security appliances (FortiOS-based firewalls and gateways, FortiSwitchManager, and FortiSASE), which are often positioned at network perimeters and management planes, making compromise a potential gateway for lateral movement into enterprise environments. An attacker gaining control of these devices could intercept or manipulate network traffic, exfiltrate sensitive configuration data, pivot to internal network segments, or cause denial of service (FortiGuard Advisory, Arctic Wolf).

As of the time of reporting, there is no known public proof-of-concept exploit and no confirmed evidence of in-the-wild exploitation (FortiGuard Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.024% (0.000240), indicating a currently low probability of exploitation in the near term (Feedly). No specific threat actor attribution has been made. However, the unauthenticated, network-accessible nature of the flaw and the widespread deployment of FortiOS devices make it a high-priority target for future weaponization.

1. Reconnaissance: Use tools such as Shodan or Censys to identify internet-facing FortiOS or FortiSwitchManager devices running vulnerable versions (FortiOS 6.4.x, 7.0.0–7.0.17, 7.2.0–7.2.11, 7.4.0–7.4.8, 7.6.0–7.6.3; FortiSwitchManager 7.0.0–7.0.5, 7.2.0–7.2.6).
2. Identify exposed CAPWAP service: Confirm that the target device has the "fabric" access service enabled on one or more interfaces, which exposes the cw_acd daemon on UDP ports 5246–5249.
3. Craft malicious CAPWAP packets: Construct specially crafted CAPWAP control packets designed to trigger a heap-based buffer overflow in the cw_acd daemon's packet parsing logic.
4. Bypass memory protections: Account for ASLR and PIE mitigations — this may require information leak primitives or heap spray techniques to reliably control execution flow, increasing the preparation effort.
5. Achieve remote code execution: Successfully trigger the overflow to redirect execution to attacker-controlled code, enabling arbitrary command execution as the daemon's process context on the FortiOS device (FortiGuard Advisory).

• Network: Unexpected or anomalous UDP traffic to ports 5246–5249 (CAPWAP control) from untrusted or external IP addresses; large or malformed CAPWAP control packets from non-managed access point IPs.
• Logs: FortiOS system logs showing crashes or restarts of the cw_acd daemon; unexpected error messages related to CAPWAP processing; authentication events from unknown sources on management interfaces.
• Process: Unexpected child processes spawned from the cw_acd daemon; unusual outbound connections initiated by FortiOS system processes to external IPs.
• File System: Unexpected modifications to FortiOS configuration files or the addition of unauthorized administrator accounts; presence of unknown scripts or binaries in writable directories (FortiGuard Advisory, Arctic Wolf).

Fortinet has released patched versions for all affected product lines: FortiOS should be upgraded to 7.6.4+, 7.4.9+, 7.2.12+, 7.0.18+, or 6.4.17+ (note: FortiOS 6.4 all versions are affected and users should migrate to a fixed release); FortiSwitchManager should be upgraded to 7.2.7+ or 7.0.6+; FortiSASE should be updated to 25.1.51 or 25.1.39 or later (FortiGuard Advisory). As an interim workaround, administrators can remove "fabric" access from each interface (eliminating exposure of the cw_acd daemon) or block CAPWAP control access to UDP ports 5246–5249 via a local-in policy, restricting access only to trusted managed device IPs. Fortinet provides a recommended upgrade path tool at https://docs.fortinet.com/upgrade-tool to assist with version transitions (FortiGuard Advisory).

The CIS (MS-ISAC) issued an advisory noting that multiple vulnerabilities in Fortinet products, including CVE-2025-25249, could allow for arbitrary code execution, urging organizations to apply patches promptly (CIS Advisory). Arctic Wolf published a threat intelligence blog post covering the vulnerability and recommending immediate patching (Arctic Wolf). Security news outlets including GBHackers, SecurityOnline, and Heise covered the disclosure, highlighting the critical nature of the unauthenticated RCE risk in widely deployed Fortinet infrastructure. Belgium's Centre for Cybersecurity (CCB) also issued a warning urging organizations to patch immediately (CCB Advisory). Community sentiment on social media and security forums reflects urgency given Fortinet's history of actively exploited vulnerabilities.