A locked side door on your castle wall that opens with the right magic packet
CVE-2025-25249 is a heap-based buffer overflow (CWE-122) in the cw_acd (CAPWAP Wireless Aggregate Controller) daemon in FortiOS and FortiSwitchManager. An unauthenticated remote attacker can send crafted UDP packets to ports 5246–5249 to overflow a heap buffer and achieve arbitrary code execution on the appliance. The affected version range is massive: FortiOS 6.4.0–16, 7.0.0–17, 7.2.0–11, 7.4.0–8, and 7.6.0–3, plus FortiSwitchManager 7.0.0–5 and 7.2.0–6. Fixed versions are FortiOS 6.4.17, 7.0.18, 7.2.12, 7.4.9, 7.6.4 and FortiSwitchManager 7.0.6, 7.2.7.
Fortinet rates this HIGH at 8.1 (CVSS:3.1 AV:N/AC:H/PR:N/UI:N), and this is broadly fair. The key nuance is that the CAPWAP daemon listens on UDP 5246–5249 and is only reachable on interfaces with fabric access enabled. In most deployments, this is the internal LAN or a dedicated management VLAN — not the WAN interface. Combined with AC:H (heap manipulation is notoriously unreliable without info leaks), the real-world exploitability is meaningfully lower than a typical AV:N/AC:L bug. However, because a successful exploit yields root-equivalent code execution on a perimeter firewall, the blast radius is catastrophic. We hold the vendor’s HIGH bucket but nudge the score down to 7.8 to reflect the CAPWAP-internal-facing friction.
4 steps from start to impact.
Identify CAPWAP-exposed FortiGate
- Network access to UDP 5246–5249 on a FortiGate or FortiSwitchManager interface with fabric access enabled
- CAPWAP is typically bound to internal/management interfaces, not WAN
- UDP scanning is noisier and less reliable than TCP
Craft malicious CAPWAP packet
cw_acd daemon that overflows a heap buffer. Because CVSS marks AC:H, the exploit requires precise heap layout manipulation. No public PoC exists, so the attacker must reverse-engineer the daemon binary from firmware or develop the exploit independently. Heap ASLR and other mitigations on FortiOS (Linux-based) add complexity.- Custom exploit code for the specific FortiOS version and architecture
- Knowledge of heap layout / info leak primitive
- No public PoC or exploit framework module exists as of September 2026
- Heap-based overflows on hardened Linux are unreliable without a separate info-leak vulnerability
- Different FortiOS branches may require different exploit variants
Achieve code execution on FortiGate
cw_acd daemon, which runs with elevated privileges on FortiOS. From here, the attacker has root-equivalent access to the firewall appliance, including access to VPN credentials, routing tables, firewall policies, and the ability to intercept or modify traffic.- Successful exploitation of step 2
- FortiOS integrity checking may detect unauthorized code in some configurations
- Exploitation may crash the daemon, causing a visible service disruption that triggers NOC alerts
Pivot to internal network
- Maintained access from step 3
- Network segmentation behind the firewall may limit blast radius
- EDR on internal hosts may detect lateral movement originating from the firewall IP
The supporting signals.
| In-the-Wild Exploitation | Not observed. No known campaigns as of September 2026. Not listed in CISA KEV. |
|---|---|
| PoC Availability | None public. No exploit code on GitHub, ExploitDB, or Metasploit. No researcher disclosure of working PoC. |
| EPSS Score | 0.00759 (approximately 76th percentile) — low predicted exploitation probability. |
| KEV Status | Not listed in CISA Known Exploited Vulnerabilities catalog. |
| CVSS Vector | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H — network-accessible, high complexity, no auth needed, full CIA impact. The AC:H is the critical friction factor. |
| Affected Versions | FortiOS 6.4.0–16, 7.0.0–17, 7.2.0–11, 7.4.0–8, 7.6.0–3; FortiSwitchManager 7.0.0–5, 7.2.0–6; FortiSASE 25.1.a.2, 25.2.b |
| Fixed Versions | FortiOS 6.4.17, 7.0.18, 7.2.12, 7.4.9, 7.6.4; FortiSwitchManager 7.0.6, 7.2.7 |
| Scanning/Exposure | Shodan shows ~575K internet-facing FortiGate devices globally; however, CAPWAP (UDP 5246) exposure is a small subset. Most CAPWAP listeners are internal-only. Tenable plugin 275610 and Qualys ThreatPROTECT provide authenticated version detection. |
| Disclosure Date | 2026-01-13 (Fortinet advisory FG-IR-25-084) |
| Reporting | Discovered internally by Fortinet. Advisory ID: FG-IR-25-084. |
noisgate verdict.
The single most decisive factor is role multiplier — FortiGate is a network perimeter appliance where code execution yields root on the firewall, enabling credential theft, traffic interception, and full network pivot. Despite significant exploitation friction (AC:H, no PoC, internal-facing CAPWAP service), the catastrophic blast radius of a compromised perimeter firewall floors this at HIGH and prevents any downgrade to MEDIUM.
Why this verdict
- AC:H is real friction: Heap overflows on modern Linux-based FortiOS require precise heap grooming and likely a separate info-leak primitive. This is not a script-kiddie bug — weaponization requires significant reverse-engineering effort and is version-specific.
- CAPWAP is typically internal-facing: The
cw_acddaemon serves FortiAP wireless controllers over UDP 5246–5249. In standard deployments, this port is only reachable from internal VLANs or management networks, not from the internet. This dramatically narrows the unauthenticated-remote attack surface. - Role multiplier — FortiGate is a canonical network edge appliance: Despite the friction above, a successful exploit yields root-equivalent access on a perimeter firewall. The blast radius is fleet-scale: VPN credential harvesting, firewall policy manipulation, traffic interception, and lateral pivot into the entire protected network. The 2026 FortiBleed campaign demonstrated that compromised FortiGate access directly enables ransomware deployment across enterprises. This role multiplier floors the verdict at HIGH.
- No PoC, no KEV, low EPSS: As of September 2026, there is zero evidence of weaponization. EPSS at 0.76% reflects low near-term exploitation probability. This prevents escalation to CRITICAL despite the role multiplier.
- Massive affected version range: Every supported FortiOS branch from 6.4 through 7.6 is affected, meaning nearly every FortiGate in production is vulnerable until patched. This breadth increases the population at risk even if per-device exploitability is constrained.
Why not higher?
Escalation to CRITICAL would require either active exploitation, a public PoC, or low attack complexity. The AC:H rating is substantive here — heap overflows in compiled daemons on hardened Linux are genuinely difficult to weaponize reliably without info leaks. The CAPWAP daemon’s typical internal-only exposure further reduces the realistic attack surface below what AV:N alone would suggest. With no PoC and no KEV listing after 8 months, the exploitation timeline remains speculative.
Why not lower?
Downgrading to MEDIUM would ignore the catastrophic blast radius of firewall compromise. FortiGate is *the* perimeter trust boundary for hundreds of thousands of enterprises. Root on the firewall is not a contained incident — it is a full network breach. The unauthenticated nature of the attack (PR:N) and the network vector (AV:N) mean that any misconfiguration exposing CAPWAP to a broader network instantly removes the internal-only friction. The FortiBleed precedent in 2026 demonstrates that Fortinet appliance compromise is actively weaponized at scale by ransomware operators.
What to do — in priority order.
- Remove fabric access from WAN-facing interfaces immediately — The CAPWAP daemon is only reachable on interfaces with
set allowaccess fabricconfigured. Removing fabric access from any internet-facing or untrusted interface eliminates remote exploitation. Deploy within 30 days per the noisgate mitigation SLA for HIGH. Fortinet documents this workaround in FG-IR-25-084. - Block UDP 5246–5249 with local-in policy — Create a FortiOS local-in policy to deny inbound CAPWAP traffic from untrusted zones. This is a defense-in-depth measure even if fabric access is already removed. Deploy within 30 days.
- Restrict CAPWAP to a dedicated management VLAN — Ensure FortiAP management traffic is isolated to a purpose-built VLAN with ACLs preventing access from user or server segments. This limits the attack surface to only the AP management network.
- Enable FortiOS anomaly-based IPS for CAPWAP — Configure IPS signatures to detect malformed CAPWAP packets. While no specific signature exists for this CVE, anomaly detection on UDP 5246 may catch exploitation attempts.
- Monitor for unexpected cw_acd crashes — Forward FortiOS crash logs and daemon restart events to your SIEM. A crashed cw_acd process is a strong indicator of exploitation attempts against this vulnerability.
- WAF/reverse proxy — this is a UDP-based protocol flaw, not an HTTP vulnerability. Web application firewalls provide zero coverage.
- FortiGate admin interface lockdown — restricting HTTPS management access (port 443) does not affect CAPWAP (UDP 5246). These are separate daemons on separate ports.
- SSL VPN hardening — the CAPWAP daemon is unrelated to SSL VPN functionality. VPN-specific mitigations do not reduce this attack surface.
Crowdsourced verification payload.
Run this script on the FortiGate appliance via SSH (or via FortiManager script push). Requires CLI admin access. Example: ssh admin@fortigate-01 < check_cve_2025_25249.sh
#!/bin/bash\n# CVE-2025-25249 FortiOS CAPWAP Heap Overflow Check\n# Run on FortiGate via SSH or console\n# Requires: CLI admin access\n# Outputs: VULNERABLE / PATCHED / UNKNOWN\n\nVERSION=$(cli2json sys status 2>/dev/null | grep -oP '"Version":\s*"v([^"]+)"' | grep -oP 'v[0-9.]+' || get system status 2>/dev/null | grep -i 'version' | head -1 | grep -oP '[0-9]+\\.[0-9]+\\.[0-9]+')\n\nif [ -z \"$VERSION\" ]; then\n # Try FortiOS CLI directly\n VERSION=$(echo \"get system status\" | fnsysctl 2>/dev/null | grep -oP 'v[0-9]+\\.[0-9]+\\.[0-9]+')\nfi\n\nif [ -z \"$VERSION\" ]; then\n echo \"UNKNOWN - Could not determine FortiOS version\"\n exit 2\nfi\n\necho \"Detected FortiOS version: $VERSION\"\n\n# Parse major.minor.patch\nMAJOR=$(echo \"$VERSION\" | sed 's/^v//' | cut -d. -f1)\nMINOR=$(echo \"$VERSION\" | sed 's/^v//' | cut -d. -f2)\nPATCH=$(echo \"$VERSION\" | sed 's/^v//' | cut -d. -f3)\n\nPATCHED=0\n\n# Check against fixed versions\nif [ \"$MAJOR\" -eq 7 ] && [ \"$MINOR\" -eq 6 ] && [ \"$PATCH\" -ge 4 ]; then PATCHED=1; fi\nif [ \"$MAJOR\" -eq 7 ] && [ \"$MINOR\" -eq 4 ] && [ \"$PATCH\" -ge 9 ]; then PATCHED=1; fi\nif [ \"$MAJOR\" -eq 7 ] && [ \"$MINOR\" -eq 2 ] && [ \"$PATCH\" -ge 12 ]; then PATCHED=1; fi\nif [ \"$MAJOR\" -eq 7 ] && [ \"$MINOR\" -eq 0 ] && [ \"$PATCH\" -ge 18 ]; then PATCHED=1; fi\nif [ \"$MAJOR\" -eq 6 ] && [ \"$MINOR\" -eq 4 ] && [ \"$PATCH\" -ge 17 ]; then PATCHED=1; fi\n# Versions below 6.4 are EOL and likely vulnerable\nif [ \"$MAJOR\" -gt 7 ]; then PATCHED=1; fi\nif [ \"$MAJOR\" -eq 7 ] && [ \"$MINOR\" -gt 6 ]; then PATCHED=1; fi\n\nif [ \"$PATCHED\" -eq 1 ]; then\n echo \"PATCHED - FortiOS $VERSION is at or above the fixed version for CVE-2025-25249\"\n exit 0\nelse\n echo \"VULNERABLE - FortiOS $VERSION is affected by CVE-2025-25249. Upgrade to fixed version.\"\n exit 1\nfiIf you remember one thing.
Sources
What defenders are saying.
Crowdsourced verification outputs.
Results submitted by users who ran the verification payload against their environment.