Critical RCE Vulnerability in Fortinet Products via AuthHash Cookie (CVE-2025-32756)

CVE-2025-32756 is a critical stack-based buffer overflow vulnerability affecting a wide range of Fortinet products, including FortiMail, FortiNDR, FortiRecorder, FortiVoice, and FortiCamera. The flaw exists in the handling of the 'enc' parameter within the 'AuthHash' cookie when processed by the '/remote/hostcheck_validate' endpoint. Because this endpoint is reachable without authentication, remote attackers can trigger the buffer overflow by sending specifically crafted HTTP requests. Public proof-of-concept exploit code has been released, allowing for the discovery and exploitation of vulnerable systems. Defenders should prioritize patching or restricting access to the vulnerable endpoint immediately, as this vulnerability carries a CVSS score of 9.8.

Attack Chain

1. Attacker performs reconnaissance or network scanning to identify reachable Fortinet devices.
2. Attacker targets the '/remote/hostcheck_validate' URI on the discovered Fortinet appliance.
3. Attacker crafts a malicious HTTP request containing a specially formed 'AuthHash' cookie.
4. Attacker inserts a payload into the 'enc' parameter within the cookie, designed to exceed the allocated stack buffer.
5. The target Fortinet appliance processes the cookie, triggering the buffer overflow condition during memory handling.
6. Attacker potentially gains control of the instruction pointer to achieve arbitrary code execution.

Impact

Successful exploitation of CVE-2025-32756 results in unauthenticated remote code execution, granting attackers the ability to compromise the confidentiality, integrity, and availability of the affected Fortinet appliances. These devices are often positioned at the network perimeter, and their compromise could facilitate deeper network penetration or interception of organizational traffic.

Recommendation

• Upgrade FortiMail to 7.0.9, 7.2.8, 7.4.5, 7.6.3 or later.
• Upgrade FortiNDR to 7.0.7, 7.2.5, 7.4.8, 7.6.1 or later.
• Upgrade FortiRecorder to 6.4.6, 7.0.6, 7.2.4 or later.
• Upgrade FortiVoice to 6.4.11, 7.0.7, 7.2.1 or later.
• Upgrade FortiCamera to 2.1.4 or later.
• Monitor web server access logs for anomalous POST or GET requests targeting the '/remote/hostcheck_validate' path, specifically looking for unusually long or malformed 'AuthHash' cookie strings.
• Implement access controls to restrict exposure of administrative or authentication-related endpoints to untrusted networks.