CVE-2025-46776: Fortinet FortiExtender Buffer Overflow

CVE-2025-46776 Overview

CVE-2025-46776 is a classic buffer overflow vulnerability [CWE-120] affecting Fortinet FortiExtender firmware. The flaw resides in the command-line interface (CLI) handler, where input is copied without proper size validation. An authenticated attacker with local access can send crafted CLI commands to trigger memory corruption and execute arbitrary code or commands on the device.

The vulnerability affects FortiExtender versions 7.6.0 through 7.6.1, 7.4.0 through 7.4.6, and all versions of the 7.2 and 7.0 branches. Fortinet published the advisory on November 18, 2025.

Critical Impact
An authenticated user can execute arbitrary code or commands on affected FortiExtender devices by sending crafted CLI input, resulting in full compromise of device confidentiality, integrity, and availability.

Affected Products

Fortinet FortiExtender 7.6.0 through 7.6.1
Fortinet FortiExtender 7.4.0 through 7.4.6
Fortinet FortiExtender 7.2 (all versions) and 7.0 (all versions)

Discovery Timeline

2025-11-18 - CVE-2025-46776 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-46776

Vulnerability Analysis

The vulnerability is a classic buffer overflow [CWE-120] in the FortiExtender CLI processing logic. The affected code path copies user-supplied CLI input into a fixed-size buffer without validating the input length against the destination size. When an authenticated user submits a crafted command exceeding the expected boundary, adjacent memory is overwritten.

Successful exploitation allows the attacker to corrupt process state and redirect execution flow. Because the CLI process on FortiExtender runs with elevated privileges, attackers can execute arbitrary code or system commands on the underlying operating system. Impact spans confidentiality, integrity, and availability of the device.

Exploitation requires an authenticated session and local access to the CLI, which reduces the attack surface but does not eliminate risk. Compromised or low-privilege administrative accounts, shared credentials, or lateral movement from a compromised management host can all be used to reach the vulnerable interface.

Root Cause

The root cause is the absence of bounds checking on input passed to a strcpy-style copy operation within a CLI command handler. The destination buffer has a fixed size, but the source length is attacker-controlled and unvalidated, producing a stack or heap overflow depending on the specific code path.

Attack Vector

An authenticated attacker connects to the FortiExtender CLI over a local management channel (serial, SSH from an allowed management network, or an existing administrative session). The attacker issues a specially crafted command containing an oversized argument. The overflow corrupts control data and enables arbitrary code or command execution in the context of the CLI process.

No verified public proof-of-concept code has been released for CVE-2025-46776. Refer to the Fortinet Security Advisory FG-IR-25-251 for vendor technical details.

Detection Methods for CVE-2025-46776

Indicators of Compromise

Unexpected FortiExtender CLI process crashes or restarts recorded in device event logs.
Administrative CLI sessions issuing unusually long or malformed command arguments.
New or unknown administrative accounts, configuration changes, or scheduled tasks appearing after a suspicious CLI session.
Outbound connections from the FortiExtender to unfamiliar hosts following administrative activity.

Detection Strategies

Enable CLI command auditing on FortiExtender and forward logs to a centralized SIEM for inspection.
Alert on CLI input strings exceeding expected argument length thresholds for known commands.
Correlate authentication events with subsequent configuration changes to detect abuse of compromised administrator accounts.

Monitoring Recommendations

Monitor FortiExtender syslog for crashlog, segmentation fault, or process restart entries tied to CLI sessions.
Track administrative logins by source IP and time-of-day to identify anomalous access patterns.
Ingest FortiExtender telemetry into a centralized logging platform to preserve evidence for forensic review.

How to Mitigate CVE-2025-46776

Immediate Actions Required

Upgrade FortiExtender to a fixed release as identified in Fortinet Security Advisory FG-IR-25-251.
Restrict CLI and management access to a dedicated management network and trusted administrator hosts only.
Rotate all administrative credentials and audit existing accounts for legitimacy.

Patch Information

Fortinet has published fixed versions and remediation guidance in advisory FG-IR-25-251. Administrators running FortiExtender 7.6.0–7.6.1, 7.4.0–7.4.6, or any 7.2 or 7.0 release should upgrade to the vendor-recommended fixed builds. Consult the Fortinet Security Advisory FG-IR-25-251 for exact version guidance.

Workarounds

Limit administrative CLI access to a small set of authorized users and enforce strong, unique credentials with multi-factor authentication where supported.
Place FortiExtender management interfaces behind an out-of-band management network with strict access control lists.
Enable session logging and require administrator activity to be recorded for post-incident review until patching completes.

bash

# Configuration example: restrict administrative access to trusted hosts
config system admin
    edit "admin"
        set trusthost1 10.10.0.0 255.255.255.0
        set accprofile "super_admin"
    next
end