CVE-2025-25249

CriticalCVSS 9.8/10Known exploited (CISA KEV)Last modified Oct 7, 2026

Description

A heap-based buffer overflow vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2.0 through 7.2.11, FortiOS 7.0.0 through 7.0.17, FortiOS 6.4 all versions, FortiSwitchManager 7.2.0 through 7.2.6, FortiSwitchManager 7.0.0 through 7.0.5 allows attacker to execute unauthorized code or commands via specially crafted packets

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-122CWE-787

Affected software

VendorProductVersions
FortinetFortiSwitchManager>= 7.2.2, <= 7.2.5
FortinetFortiOS>= 7.6.0, <= 7.6.2; >= 7.4.0, <= 7.4.7; >= 7.2.4, <= 7.2.11
SiemensRUGGEDCOM APE1808< *

References

Timeline

Published
Jan 13, 2026
Last modified
Oct 7, 2026
Added to CISA KEV
Sep 9, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-25258.8The Streamit theme for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'st_Authentication_ContrCVE-2025-252504.3An Exposure of Sensitive Information to an Unauthorized Actor vulnerability [CWE-200] vulnerability in Fortinet FortiOS 7.6.0, FortiOS 7.4.0CVE-2025-252517.8An Incorrect Authorization vulnerability [CWE-863] in FortiClient Mac 7.4.0 through 7.4.2, 7.2.0 through 7.2.8, 7.0.0 through 7.0.14 may allCVE-2025-252526.5An Insufficient Session Expiration vulnerability [CWE-613] in FortiOS SSL VPN 7.6.0 through 7.6.2, 7.4.0 through 7.4.6, 7.2.0 through 7.2.10CVE-2025-252537.5An Improper Validation of Certificate with Host Mismatch vulnerability [CWE-297] in FortiProxy version 7.6.1 and below, version 7.4.8 and beCVE-2025-252547.2An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability [CWE-22] in FortiWeb version 7.6.2 and belowCVE-2025-252554.3An Improperly Implemented Security Check for Standard vulnerability [CWE-358] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiPrCVE-2025-252569.8An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability [CWE-78] vulnerability in FortinCVE-2025-252579.8An improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability [CWE-89] vulnerability in Fortinet ForCVE-2025-25268.8The Streamit theme for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 4.0.2. ThiCVE-2025-252646.5An unauthenticated remote attacker can trick an admin to visit a website containing malicious java script code. The current overly permissivCVE-2025-252654.9A web application for configuring the controller is accessible at a specific path. It contains an endpoint that allows a high privileged rem
CVE-2025-25249: Critical severity, CVSS 9.8 | Vulnix