CVE-2025-32756
CRITICAL KEV RANSOMWAREFortinet Fortimail < 7.0.9 - Out-of-Bounds Write
Title source: ruleExploitation Summary
CVE-2025-32756 is actively exploited and listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added May 14, 2025, with confirmed use in ransomware campaigns. EIP tracks 6 public exploits from researchers including kn0x0x, cybersecplayground, exfil0.
AI-analyzed exploit summary This repository contains a proof-of-concept exploit for CVE-2025-32756, a critical stack-based buffer overflow vulnerability in Fortinet products. The exploit demonstrates the vulnerability by triggering the buffer overflow condition in the AuthHash cookie processing of the `/remote/hostcheck_validate` endpoint.
Description
A stack-based buffer overflow vulnerability [CWE-121] vulnerability in Fortinet FortiCamera 2.1.0 through 2.1.3, FortiCamera 2.0 all versions, FortiCamera 1.1 all versions, FortiMail 7.6.0 through 7.6.2, FortiMail 7.4.0 through 7.4.4, FortiMail 7.2.0 through 7.2.7, FortiMail 7.0.0 through 7.0.8, FortiNDR 7.6.0, FortiNDR 7.4.0 through 7.4.7, FortiNDR 7.2.0 through 7.2.4, FortiNDR 7.0.0 through 7.0.6, FortiRecorder 7.2.0 through 7.2.3, FortiRecorder 7.0.0 through 7.0.5, FortiRecorder 6.4.0 through 6.4.5, FortiVoice 7.2.0, FortiVoice 7.0.0 through 7.0.6, FortiVoice 6.4.0 through 6.4.10 allows a remote unauthenticated attacker to execute arbitrary code or commands via sending HTTP requests with specially crafted hash cookie.
Exploits (6)
This repository contains a proof-of-concept exploit for CVE-2025-32756, a critical stack-based buffer overflow vulnerability in Fortinet products. The exploit demonstrates the vulnerability by triggering the buffer overflow condition in the AuthHash cookie processing of the `/remote/hostcheck_validate` endpoint.
The repository contains detailed technical writeups for multiple CVEs, including command injection, XXE, SQLi, and RCE vulnerabilities. Each writeup provides vulnerability overviews, proof-of-concept details, and mitigation recommendations.
The repository contains a partial Python-based PoC framework for CVE-2025-32756, targeting Fortinet software. The code includes extensive setup for logging, dependency checks, and utility functions but lacks the core exploit logic or payload delivery mechanism.
The repository contains a partial Python script for CVE-2025-32756, focusing on utility functions and setup without actual exploit logic. It includes dependencies like pwntools and requests but lacks payload delivery or vulnerability-specific code.
The repository contains only a README.md file with minimal information about CVE-2025-32756, listing affected Fortinet products without technical details or exploit code.
This PoC demonstrates a stack-based buffer overflow in Fortinet products (CVE-2025-32756) via malformed AuthHash cookie processing in the `/remote/hostcheck_validate` endpoint. It crafts payloads to trigger the overflow but does not include a full RCE payload.
References (2)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H