Fortinet fixed actively exploited FortiVoice zero-day

Fortinet fixed a critical remote code execution zero-day vulnerability actively exploited in attacks targeting FortiVoice enterprise phone systems.

Fortinet released security updates to address a critical remote code execution zero-day, tracked as CVE-2025-32756, that was exploited in attacks targeting FortiVoice enterprise phone systems.

The vulnerability is a stack-based overflow issue that impacts in FortiVoice, FortiMail, FortiNDR, FortiRecorder and FortiCamera. A remote unauthenticated attackers can exploit the flaw to execute arbitrary code or commands via maliciously crafted HTTP requests.

“A stack-based overflow vulnerability [CWE-121] in FortiVoice, FortiMail, FortiNDR, FortiRecorder and FortiCamera may allow a remote unauthenticated attacker to execute arbitrary code or commands via crafted HTTP requests.” reads the advisory. “Fortinet has observed this to be exploited in the wild on FortiVoice.”

The company states that the threat actor that exploited the flaw scanned the network, erased crash logs, and enabled fcgi debugging to capture system or SSH login credentials.

The cybersecurity vendor observed attackers deploying malware on compromised servers, adding credential-stealing cron jobs, and using scripts to scan victim networks.

According to Indicators of Compromise shared by Fortinet, the attacks originated from half a dozen IP addresses, including 198.105.127[.]124, 43.228.217[.]173, 43.228.217[.]82, 156.236.76[.]90, 218.187.69[.]244, and 218.187.69[.]59.

Indicators of compromise also include the ‘fcgi debugging’ setting which was enabled on compromised systems.

“To verify if fcgi debugging is enabled on your system, use the following CLI command:

diag debug application fcgi

If the output shows “general to-file ENABLED”, it means fcgi debugging is enabled on your system:

fcgi debug level is 0x80041
general to-file ENABLED

This is not a default setting, so unless you have enabled it in the past, this is potentially an Indicator of Compromise” continues the advisory.

Fortinet found attackers deploying malware, adding credential-stealing cron jobs, and using scripts to scan victim networks.

The company recommends disabling HTTP/HTTPS administrative interface as a workaround.

The flaw was discovered by Fortinet Product Security Team.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, FortiVoice)