Attack Chain

1. Attacker performs reconnaissance or network scanning to identify reachable Fortinet devices.
2. Attacker targets the '/remote/hostcheck_validate' URI on the discovered Fortinet appliance.
3. Attacker crafts a malicious HTTP request containing a specially formed 'AuthHash' cookie.
4. Attacker inserts a payload into the 'enc' parameter within the cookie, designed to exceed the allocated stack buffer.
5. The target Fortinet appliance processes the cookie, triggering the buffer overflow condition during memory handling.
6. Attacker potentially gains control of the instruction pointer to achieve arbitrary code execution.

Impact

Successful exploitation of CVE-2025-32756 results in unauthenticated remote code execution, granting attackers the ability to compromise the confidentiality, integrity, and availability of the affected Fortinet appliances. These devices are often positioned at the network perimeter, and their compromise could facilitate deeper network penetration or interception of organizational traffic.

Recommendation

• Upgrade FortiMail to 7.0.9, 7.2.8, 7.4.5, 7.6.3 or later.
• Upgrade FortiNDR to 7.0.7, 7.2.5, 7.4.8, 7.6.1 or later.
• Upgrade FortiRecorder to 6.4.6, 7.0.6, 7.2.4 or later.
• Upgrade FortiVoice to 6.4.11, 7.0.7, 7.2.1 or later.
• Upgrade FortiCamera to 2.1.4 or later.
• Monitor web server access logs for anomalous POST or GET requests targeting the '/remote/hostcheck_validate' path, specifically looking for unusually long or malformed 'AuthHash' cookie strings.
• Implement access controls to restrict exposure of administrative or authentication-related endpoints to untrusted networks.