CVE-2025-32756

描述： A stack-based buffer overflow vulnerability [CWE-121] in Fortinet FortiVoice versions 7.2.0, 7.0.0 through 7.0.6, 6.4.0 through 6.4.10, FortiRecorder versions 7.2.0 through 7.2.3, 7.0.0 through 7.0.5, 6.4.0 through 6.4.5, FortiMail versions 7.6.0 through 7.6.2, 7.4.0 through 7.4.4, 7.2.0 through 7.2.7, 7.0.0 through 7.0.8, FortiNDR versions 7.6.0, 7.4.0 through 7.4.7, 7.2.0 through 7.2.4, 7.0.0 through 7.0.6, FortiCamera versions 2.1.0 through 2.1.3, 2.0 all versions, 1.1 all versions, allows a remote unauthenticated attacker to execute arbitrary code or commands via sending HTTP requests with specially crafted hash cookie.

---

Based on the analysis by Horizion3, we know this is an unauthenticated stack-based buffer overflow, affecting multiple Fortinet products; including FortiVoice, FortiRecorder, FortiNDR, FortiMail, and FortiCamera. An unauthenticated HTTP POST request to the /module/admin.fe endpoint will trigger the overflow, if a HTTP form parameter named AuthHash is larger than 16 bytes. The vendor advisory indicates this vulnerability was being successfully exploited in the wild by an unknown threat actor who was targeting FortiVoice device. Based upon the threat actor activity, such as modifying files in the /bin directory, and adding new cron jobs, it appears the attacker gained privileged access via this vulnerability.

I have rated the Attacker Value as High, and the Exploitability as Medium, as this is a memory corruption vulnerability.