Threat actors are exploiting a heap-based buffer-overflow vulnerability tracked as CVE-2025-25249 to compromise FortiGate appliances and deploy a custom Node.js command-and-control framework called PivotC2, according to an investigation by SOCRadar’s Threat Research Unit. The vulnerability affects FortiOS, FortiSwitchManager, and certain FortiSASE releases, allowing unauthenticated remote attackers to execute arbitrary code or commands by sending specially crafted network packets to vulnerable devices.
Understanding the CVE-2025-25249 FortiOS Vulnerability
The flaw resides in the cw_acd daemon, a Fortinet component handling the Control and Provisioning of Wireless Access Points protocol, commonly known as CAPWAP. According to vulnerability disclosures, software writes more data into an allocated memory region than intended, causing memory corruption that alters program behavior. The NIST National Vulnerability Database assigns the issue a CVSS 3.1 score of 8.1, while vendor reporting cites a score of 7.3, placing both ratings in the high-severity category. Fortinet discovered the bug internally and published advisory FG-IR-25-084 in January 2026, though SOCRadar’s subsequent findings indicate threat actors quickly incorporated the flaw into real-world intrusion operations.
How PivotC2 Turns Firewalls Into Attack Platforms
PivotC2 operates directly on compromised FortiGate systems rather than traditional employee workstations, functioning as a pivoting and command-and-control platform. Because network appliances remain continuously online with extensive traffic visibility, attackers use them as covert relay points to conceal malicious communications and launch follow-up operations against internal assets. Security investigators note that JavaScript-based runtimes like Node.js provide built-in networking capabilities and asynchronous communications, making modular command-and-control tools easier to build while complicating analysis for defenders expecting native binaries on network hardware.
Pro Tip: Network administrators should review outbound communications originating directly from perimeter firewalls. A properly functioning gateway should never initiate unprompted connections to unfamiliar internet hosts.
Comparing Incident Campaigns Across Enterprise Networks
Separate investigations highlight distinct post-exploitation behaviors following firewall compromises. While SOCRadar documented the deployment of the PivotC2 framework via CVE-2025-25249, incident responders at SentinelOne identified concurrent attacks abusing separate authentication bypass flaws—including CVE-2025-59718, CVE-2025-59719, and CVE-2026-24858. In those separate incidents, attackers extracted reversible configuration files to steal LDAP and Active Directory service account credentials, created rogue accounts like “support” and “ssl-admin,” and leveraged cloud storage buckets to host payloads disguised as software updates.
| Threat Indicator | PivotC2 Campaign (SOCRadar) | Credential Theft Campaign (SentinelOne) |
|---|---|---|
| Primary Vulnerability | CVE-2025-25249 (CAPWAP heap overflow) | CVE-2025-59718, CVE-2025-59719, CVE-2026-24858 |
| Malware Framework | PivotC2 (Node.js-based) | Pulseway, MeshAgent, SoftPerfect Scanner |
| Operational Impact | Firewall converted to pivot and relay platform | Configuration theft and NTDS.dit database exfiltration |
Mitigation and Retrospective Incident Response Steps
Organizations must immediately upgrade vulnerable systems to corrected Fortinet releases, but security teams emphasize that patching alone cannot remove existing intruders. Because attackers establish persistence, modify configurations, or create rogue administrator accounts, administrators must conduct retrospective reviews of configuration history, VPN settings, and local-in policies. Where compromise is suspected, experts advise rebuilding the appliance from a trusted firmware image, restoring only verified configurations, and rotating administrative secrets from a known-clean machine. For organizations unable to upgrade immediately, Fortinet recommends restricting CAPWAP control traffic on UDP ports 5246 through 5249 using local-in policies.
Did You Know? Perimeter security devices are frequently targeted by threat actors because standard endpoint detection and response agents cannot run natively on proprietary firewall operating systems.
Frequently Asked Questions
What products are affected by CVE-2025-25249?
The heap-based buffer overflow affects multiple branches of FortiOS, FortiSwitchManager, and certain FortiSASE releases.
%20(1).webp "Photo: cyberpress.org")
Does installing the security patch remove existing malware from a firewall?
No. According to security investigations, applying a patch prevents future exploitation but does not automatically remove unauthorized accounts, modified configurations, or implanted frameworks like PivotC2.
What temporary mitigations are available if patching is delayed?
Fortinet advises restricting CAPWAP control traffic on UDP ports 5246 through 5249 with a local-in policy and limiting access exclusively to trusted device addresses.
Call to Action: Share your organization’s network hardening strategies in the comments below, and subscribe to our newsletter for urgent cybersecurity alerts and patch updates.