A Fortinet Bug Patched in 2025 Is Now Under Attack

Fortinet rated a FortiOS remote-code-execution flaw 7.4 out of 10 when it disclosed the bug on Jan. 13, but the Cybersecurity and Infrastructure Security Agency did not add it to its Known Exploited Vulnerabilities catalog until Sept. 9, after threat-intelligence firm SOCRadar traced active exploitation back to at least July.

The flaw, CVE-2025-25249, is a heap-based buffer overflow in the cw_acd daemon, the FortiOS process that handles CAPWAP traffic on UDP port 5246 for managing wireless access points from a FortiGate firewall. An unauthenticated attacker who sends a crafted packet to that port can execute code on the device, according to Adam Skupien, a vulnerability security analyst at Triskele Labs, who published a technical breakdown of the bug. CISA's addition set a remediation deadline of Sept. 12 for federal agencies, which has already passed.

The score understates the flaw

Fortinet's own advisory scores CVE-2025-25249 between 7.3 and 7.4. The National Vulnerability Database rates the identical bug 9.8, reflecting an unauthenticated attacker who needs no account and no user interaction to run arbitrary code on an internet-facing firewall. CISA's decision to add the flaw to its exploited-vulnerabilities catalog, reserved for confirmed in-the-wild use, sides with the higher number.

Rating source	CVSS score
Fortinet PSIRT	7.3-7.4
NVD	9.8

Patches shipped well before the January disclosure: FortiOS 7.6.4 was available by August 2025, and FortiOS 7.0.18, the last of the affected branches to receive a fix, by November 2025. Fortinet has not said why it waited until January to publish the advisory, nor why CISA's KEV addition followed eight months after that.

PivotC2 and its AI tells

SOCRadar says the campaign delivers a Node.js remote-access tool it calls PivotC2, which opens a persistent outbound TLS connection to a command-and-control server, letting it bypass inbound firewall rules entirely. The implant writes itself to /tmp/.i.js and runs as a background process so it survives if its parent process is killed, and a recovered build, version 0.2.3, carries an "auto mode" flag that runs a preset command sequence immediately after infection.

SOCRadar said the tool's inline comments and usage guidance suggest it was "likely developed with the use of AI," though the firm did not publish the specific code patterns behind that conclusion. SOCRadar counted more than 30,000 targeted IP addresses and 178 confirmed PivotC2 sessions, the majority in the United States, with at least two intrusions resulting in confirmed data theft, according to SecurityWeek's reporting on the firm's findings.

Fortinet has not said how many of the 178 confirmed victims had applied the 2025 patches before the January disclosure, and SOCRadar has not published a breakdown of which FortiOS versions the compromised devices were running. CISA's three-day KEV deadlines, like the one it set for an exploited Pixel modem flaw, only start the clock once a bug is confirmed under attack. Unlike a fresh zero-day such as Adobe Commerce's StyleSmuggler flaw, this one had been patched and publicly disclosed for eight months before that clock started.