CyberCVE

CVE-2025-57740

An Heap-based Buffer Overflow vulnerability [CWE-122] in FortiOS version 7.6.2 and below, version 7.4.7 and below, version 7.2.10 and below, 7.0 all versions, 6.4 all versions; FortiPAM version 1.5.0,

Severity
Medium 6.7
CVSS 3.1
Exploited
Not listed
EPSS
0.006
46.8th percentile
Discovered by
Not disclosed
Published
Oct 14, 2025
Assigned by fortinet

Description

An Heap-based Buffer Overflow vulnerability [CWE-122] in FortiOS version 7.6.2 and below, version 7.4.7 and below, version 7.2.10 and below, 7.0 all versions, 6.4 all versions; FortiPAM version 1.5.0, version 1.4.2 and below, 1.3 all versions, 1.2 all versions, 1.1 all versions, 1.0 all versions and FortiProxy version 7.6.2 and below, version 7.4.3 and below, 7.2 all versions, 7.0 all versions RDP bookmark connection may allow an authenticated user to execute unauthorized code via crafted requests.

Weakness: CWE-122

Affected products

Vendor Product Category Matched by
Fortinet FortiOS Firewall / NGFW cna-assigner
Fortinet FortiPAM Identity / IAM / MFA cna-assigner
Fortinet FortiProxy SASE / SSE / Secure Web cna-assigner
Vendor-reported affected versions (4)
  • Fortinet · FortiPAM
  • Fortinet · FortiProxy
  • Fortinet · FortiOS
  • Siemens · RUGGEDCOM APE1808

Vendor remediation

Upgrade to FortiPAM version 1.5.1 or above Upgrade to FortiPAM version 1.4.3 or above Upgrade to FortiProxy version 7.6.3 or above Upgrade to FortiProxy version 7.4.4 or above Upgrade to FortiOS version 7.6.3 or above Upgrade to FortiOS version 7.4.8 or above Upgrade to FortiOS version 7.2.11 or above Upgrade to FortiSASE-Sovereign version 25.2 or above

References