This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.

[TLP:CLEAR] Fortinet fixes 3 vulnerabilities in various products

Fortinet fixes three vulnerabilities in various products [1][2][3], one of which is critical and actively exploited [1][4]. Individual products and their fixed versions: FortiCamera - 2.1.4 FortiClientEMS Cloud - 7.4.3 FortiClientEMS - 7.4.3 FortiClientMac - 7.2.9, 7.4.3 FortiMail - 7.0.9, 7.2.8, 7.4.5, 7.6.3 FortiNDR - 7.0.7, 7.2.5, 7.4.8, 7.6.1 FortiRecorder - 6.4.6, 7.0.6, 7.2.4 FortiVoice - 6.4.11, 7.0.7, 7.2.1 FortiVoiceUCDesktop - 7.0

Fortinet FortiVoice, FortiMail, FortiNDR, FortiRecorder, FortiCamera - RCE (CVE-2025-32756)
CVSS 9.8 (Critical)

An unauthenticated remote attacker can, due to a stack-based buffer overflow in FortiVoice, FortiMail, FortiNDR, FortiRecorder and FortiCamera, execute code or run arbitrary commands by sending specially crafted HTTP requests to the API. If an immediate update to a fixed version is not possible, it is recommended as a temporary measure to disable the HTTP/HTTPS administrative interface. Detailed information on the vulnerability is available at [1]. Fortinet has observed active exploitation of this vulnerability in systems running FortiVoice [1][4].

The vulnerability is present in products:

  • *:FortiCamera; >=1.1.0, <=2.1.3;
  • *:FortiMail; >=7.0.0, <=7.0.8; >=7.2.0, <=7.2.7; >=7.4.0, <=7.4.4; >=7.6.0, <=7.6.2;
  • *:FortiNDR; >=1.1.0, <=1.5.2; >=7.0.0, <=7.0.6; >=7.1.0, <=7.1.1; >=7.2.0, <=7.2.4; >=7.4.0, <=7.4.7; ==7.6.0;
  • *:FortiRecorder; >=6.4.0, <=6.4.5; >=7.0.0, <=7.0.5; >=7.2.0, <=7.2.3;
  • *:FortiVoice; >=6.4.0, <=6.4.10; >=7.0.0, <=7.0.6; ==7.2.0;

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

More information:

The vulnerability was publicly disclosed 13. 5. 2025.

Fortinet FortiClientEMS, FortiClientEMS Cloud - limited arbitrary file write (CVE-2025-22859)
CVSS 5.3 (Medium)

An unauthenticated remote attacker can write to files on the system in a limited way in FortiClientEMS and FortiClientEMS Cloud by means of an upload request [2].

The vulnerability is present in products:

  • *:FortiClientEMS; >=7.4.0, <=7.4.1;
  • *:FortiClientEMS Cloud; >=7.4.0, <=7.4.1;

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

More information:

The vulnerability was publicly disclosed 13. 5. 2025.

Fortinet FortiClient (macOS), FortiVoiceUC Desktop - code injection (CVE-2024-35281)
CVSS 2.5 (Low)

An authenticated local attacker can execute code in FortiClient for macOS and the FortiVoiceUC desktop application by abusing Node.js (Electron) environment variables [3].

The vulnerability is present in product:

  • MacOS:FortiClient; >=7.0.0, <=7.0.14; >=7.2.0, <=7.2.8; >=7.4.0, <=7.4.2;

CVSS: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N

More information:

The vulnerability was publicly disclosed 13. 5. 2025.

By CESNET, z.s.p.o. Michaela Ručková on 15. 5. 2025.

CESNET, z.s.p.o. Logo