Stack-based buffer overflow vulnerability in API Fortinet PSIRT Advisories Fortinet PSIRT Contact: Website: https://fortiguard.fortinet.com/faq/psirt-contact FG-IR-25-254 Final 1 1 2025-05-13T00:00:00 Current version 2025-05-13T00:00:00 2025-05-13T00:00:00 A stack-based overflow vulnerability [CWE-121] in FortiVoice, FortiMail, FortiNDR, FortiRecorder and FortiCamera may allow a remote unauthenticated attacker to execute arbitrary code or commands via crafted HTTP requests over portal and administrative interface.Fortinet has observed this to be exploited in the wild on FortiVoice.The operations performed by the Threat Actor in the case we observed were part or all of the below:Scan the device networkErase system crashlogsEnable fcgi debugging to log credentials from the system or SSH login attemptsSee IoCs below for more information None Execute unauthorized code or commands None Discovered by Théo Leleu and David Maciejak of Fortinet Product Security Team based on threat activity. FortiCamera 2.1.3 FortiCamera 2.1.2 FortiCamera 2.1.1 FortiCamera 2.1.0 FortiCamera 2.0.0 FortiCamera 1.1.5 FortiCamera 1.1.4 FortiCamera 1.1.3 FortiCamera 1.1.2 FortiCamera 1.1.1 FortiCamera 1.1.0 FortiMail 7.6.2 FortiMail 7.6.1 FortiMail 7.6.0 FortiMail 7.4.4 FortiMail 7.4.3 FortiMail 7.4.2 FortiMail 7.4.1 FortiMail 7.4.0 FortiMail 7.2.7 FortiMail 7.2.6 FortiMail 7.2.5 FortiMail 7.2.4 FortiMail 7.2.3 FortiMail 7.2.2 FortiMail 7.2.1 FortiMail 7.2.0 FortiMail 7.0.8 FortiMail 7.0.7 FortiMail 7.0.6 FortiMail 7.0.5 FortiMail 7.0.4 FortiMail 7.0.3 FortiMail 7.0.2 FortiMail 7.0.1 FortiMail 7.0.0 FortiNDR 7.6.0 FortiNDR 7.4.7 FortiNDR 7.4.6 FortiNDR 7.4.5 FortiNDR 7.4.4 FortiNDR 7.4.3 FortiNDR 7.4.2 FortiNDR 7.4.1 FortiNDR 7.4.0 FortiNDR 7.2.4 FortiNDR 7.2.3 FortiNDR 7.2.2 FortiNDR 7.2.1 FortiNDR 7.2.0 FortiNDR 7.1.1 FortiNDR 7.1.0 FortiNDR 7.0.6 FortiNDR 7.0.5 FortiNDR 7.0.4 FortiNDR 7.0.3 FortiNDR 7.0.2 FortiNDR 7.0.1 FortiNDR 7.0.0 FortiNDR 1.5.3 FortiNDR 1.5.2 FortiNDR 1.5.1 FortiNDR 1.5.0 FortiNDR 1.4.0 FortiNDR 1.3.1 FortiNDR 1.3.0 FortiNDR 1.2.0 FortiNDR 1.1.0 FortiRecorder 7.2.3 FortiRecorder 7.2.2 FortiRecorder 7.2.1 FortiRecorder 7.2.0 FortiRecorder 7.0.5 FortiRecorder 7.0.4 FortiRecorder 7.0.3 FortiRecorder 7.0.2 FortiRecorder 7.0.1 FortiRecorder 7.0.0 FortiRecorder 6.4.5 FortiRecorder 6.4.4 FortiRecorder 6.4.3 FortiRecorder 6.4.2 FortiRecorder 6.4.1 FortiRecorder 6.4.0 FortiVoice 7.2.0 FortiVoice 7.0.6 FortiVoice 7.0.5 FortiVoice 7.0.4 FortiVoice 7.0.3 FortiVoice 7.0.2 FortiVoice 7.0.1 FortiVoice 7.0.0 FortiVoice 6.4.10 FortiVoice 6.4.9 FortiVoice 6.4.8 FortiVoice 6.4.7 FortiVoice 6.4.6 FortiVoice 6.4.5 FortiVoice 6.4.4 FortiVoice 6.4.3 FortiVoice 6.4.2 FortiVoice 6.4.1 FortiVoice 6.4.0 CVE-2025-32756 FortiCamera-2.1.3 FortiCamera-2.1.2 FortiCamera-2.1.1 FortiCamera-2.1.0 FortiCamera-2.0.0 FortiCamera-1.1.5 FortiCamera-1.1.4 FortiCamera-1.1.3 FortiCamera-1.1.2 FortiCamera-1.1.1 FortiCamera-1.1.0 FortiMail-7.6.2 FortiMail-7.6.1 FortiMail-7.6.0 FortiMail-7.4.4 FortiMail-7.4.3 FortiMail-7.4.2 FortiMail-7.4.1 FortiMail-7.4.0 FortiMail-7.2.7 FortiMail-7.2.6 FortiMail-7.2.5 FortiMail-7.2.4 FortiMail-7.2.3 FortiMail-7.2.2 FortiMail-7.2.1 FortiMail-7.2.0 FortiMail-7.0.8 FortiMail-7.0.7 FortiMail-7.0.6 FortiMail-7.0.5 FortiMail-7.0.4 FortiMail-7.0.3 FortiMail-7.0.2 FortiMail-7.0.1 FortiMail-7.0.0 FortiNDR-7.6.0 FortiNDR-7.4.7 FortiNDR-7.4.6 FortiNDR-7.4.5 FortiNDR-7.4.4 FortiNDR-7.4.3 FortiNDR-7.4.2 FortiNDR-7.4.1 FortiNDR-7.4.0 FortiNDR-7.2.4 FortiNDR-7.2.3 FortiNDR-7.2.2 FortiNDR-7.2.1 FortiNDR-7.2.0 FortiNDR-7.1.1 FortiNDR-7.1.0 FortiNDR-7.0.6 FortiNDR-7.0.5 FortiNDR-7.0.4 FortiNDR-7.0.3 FortiNDR-7.0.2 FortiNDR-7.0.1 FortiNDR-7.0.0 FortiNDR-1.5.3 FortiNDR-1.5.2 FortiNDR-1.5.1 FortiNDR-1.5.0 FortiNDR-1.4.0 FortiNDR-1.3.1 FortiNDR-1.3.0 FortiNDR-1.2.0 FortiNDR-1.1.0 FortiRecorder-7.2.3 FortiRecorder-7.2.2 FortiRecorder-7.2.1 FortiRecorder-7.2.0 FortiRecorder-7.0.5 FortiRecorder-7.0.4 FortiRecorder-7.0.3 FortiRecorder-7.0.2 FortiRecorder-7.0.1 FortiRecorder-7.0.0 FortiRecorder-6.4.5 FortiRecorder-6.4.4 FortiRecorder-6.4.3 FortiRecorder-6.4.2 FortiRecorder-6.4.1 FortiRecorder-6.4.0 FortiVoice-7.2.0 FortiVoice-7.0.6 FortiVoice-7.0.5 FortiVoice-7.0.4 FortiVoice-7.0.3 FortiVoice-7.0.2 FortiVoice-7.0.1 FortiVoice-7.0.0 FortiVoice-6.4.10 FortiVoice-6.4.9 FortiVoice-6.4.8 FortiVoice-6.4.7 FortiVoice-6.4.6 FortiVoice-6.4.5 FortiVoice-6.4.4 FortiVoice-6.4.3 FortiVoice-6.4.2 FortiVoice-6.4.1 FortiVoice-6.4.0 9.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:X/RC:C https://fortiguard.fortinet.com/psirt/FG-IR-25-254 Stack-based buffer overflow vulnerability in API Reference>