# CVE-2025-25249: Fortinet Heap-Based Buffer Overflow Exploited to Deploy PivotC2 RAT on FortiGate Devices

> A Russian-speaking, financially motivated cybercrime group is mass-exploiting CVE-2025-25249, an unauthenticated heap-based buffer overflow in the cw_acd/CAPWAP daemon of FortiOS, FortiSwitchManager, and FortiSASE, to deploy PivotC2, a custom Node.js post-exploitation RAT built specifically for FortiGate appliances. The campaign has scanned 30,000+ IPs, infected at least 178 devices (mostly in the US), and produced at least two full-network intrusions with Microsoft Exchange mailbox exfiltration to Wasabi cloud storage.

- **Published:** 2026-09-10T00:00:00Z
- **Last reviewed:** 2026-09-10T14:41:21.890Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2431
- **ID:** TL-2026-2431
- **Severity:** CRITICAL (CVSS 9.8)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 18 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2025-25249

## Description

CVE-2025-25249 is a heap-based buffer overflow (CWE-787/CWE-122) in the cw_acd daemon that services the CAPWAP Control protocol on UDP/5246 in FortiOS, FortiSwitchManager, and FortiSASE. NVD and Tenable independently score the flaw CVSS v3.1 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, Critical) for the unauthenticated, single-packet remote code execution path; Fortinet's own vendor advisory reportedly assigns a lower score (~7.3-7.4) under a higher access-complexity assumption, but the exploitation observed in the wild — a single crafted CAPWAP packet triggering RCE with no prerequisites — matches the higher NVD/Tenable score. Fortinet patched the issue in January 2026 (FortiOS 7.6.4/7.4.9/7.2.12/7.0.18/6.4.17, FortiSwitchManager 7.2.7/7.0.6) via PSIRT advisory FG-IR-25-084, but active in-the-wild exploitation was confirmed no later than July 2026, prompting CISA to add the flaw to its Known Exploited Vulnerabilities catalog on 2026-09-09 with a 3-day BOD 26-04 federal remediation deadline of 2026-09-12.

The observed exploit chain uses a self-extracting Linux binary, fortirun.bin, driven by Bash/Python automation that repeatedly targets candidate IPs. Per SOCRadar and corroborating outlets, the binary fingerprints target firmware/hardware, abuses CAPWAP discovery responses to defeat ASLR, corrupts heap linked-list pointers to gain an arbitrary-write primitive, and hijacks execution to spawn a Node.js reverse shell. The reverse shell executes a single-line JavaScript stager that fetches a second-stage payload from an attacker-controlled server (observed at 146.103.99.177:8443/0c5b76709523), Base64-decodes it, and XOR-decrypts it with the key "pivot" before writing the final implant to /tmp/.i.js and launching it as a detached background process.

The deployed implant, PivotC2 (v0.2.3), is a purpose-built Node.js post-exploitation framework for FortiGate appliances. It opens outbound TLS connections to its C2 (sidestepping inbound firewall restrictions) using a compact binary framing protocol that multiplexes multiple SSH-like channels over a single connection. Capabilities include an interactive shell, file upload/download, SOCKS5/HTTP proxying, local and remote port forwarding, CIDR-based network/port scanning, and FortiGate-specific configuration harvesting — including automatic AES-256-CBC/AES-128-GCM decryption of Fortinet's encrypted (ENC) credential fields inside config-sync artifacts such as fsv_sync.dat, yielding plaintext VPN pre-shared keys, SSL-VPN credentials, wireless PSKs, LDAP bind secrets, and administrator accounts. An "--auto" mode chains a five-stage pipeline (config harvest → credential decrypt → subnet extraction → port scan → reporting) with no operator interaction required per newly infected device.

Operators scanned more than 30,000 internet-exposed FortiGate/FortiSwitchManager IPs and successfully compromised at least 178 devices, concentrated in the United States with additional infections in Chile, Colombia, and the United Kingdom. At least two confirmed intrusions against US-based organizations progressed to full network compromise, involving Active Directory enumeration, browser credential theft, RDP enablement/abuse, reverse SSH relays, and exfiltration of Microsoft Exchange mailbox (.pst) data to Wasabi S3-compatible cloud storage. Russian-language code comments, unusually detailed inline documentation/usage guidance suggestive of AI-assisted development, and financially-motivated exfiltration patterns (targeting backup/mailbox data rather than sabotage) support a high-confidence assessment of a Russian-speaking, financially driven cybercrime operator rather than a state-directed APT. A BeaconBeagle lookup on both observed C2 IPs (146.103.99.177, 46.151.29.58) returned no prior corpus matches, indicating newly stood-up or previously unindexed infrastructure.

## MITRE ATT&CK

- T1595 Active Scanning
- T1587 Develop Capabilities
- T1190 Exploit Public-Facing Application
- T1059 Command and Scripting Interpreter
- T1027 Obfuscated Files or Information
- T1552 Unsecured Credentials
- T1555 Credentials from Password Stores
- T1082 System Information Discovery
- T1046 Network Service Discovery
- T1018 Remote System Discovery
- T1021 Remote Services
- T1573 Encrypted Channel
- T1090 Proxy
- T1567 Exfiltration Over Web Service
- T1140 Deobfuscate/Decode Files or Information
- T1071.001 Application Layer Protocol
- T1572 Protocol Tunneling
- T1087.002 Account Discovery
- T1005 Data from Local System
- T1114.002 Email Collection
- T1570 Lateral Tool Transfer

## Sources

- [Fortinet Code Execution Flaw Exploited in PivotC2 RAT Attacks](https://www.securityweek.com/fortinet-code-execution-flaw-exploited-in-pivotc2-rat-attacks/)
- [CVE-2025-25249 Exploitation Delivers PivotC2, a FortiGate Post-Exploitation RAT](https://socradar.io/blog/cve-2025-25249-pivotc2-fortigate-rat/)
- [NVD - CVE-2025-25249 Detail](https://nvd.nist.gov/vuln/detail/CVE-2025-25249)
- [CISA Known Exploited Vulnerabilities Catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)
- [Hackers Actively Exploiting FortiGate Firewalls to Deploy Custom Node.js Malware](https://cybersecuritynews.com/fortigate-firewalls-hacked-to-deploy-malware/)
- [Hackers Exploit Critical FortiGate Flaw to Deploy AI-Assisted PivotC2 RAT](https://gbhackers.com/hackers-exploit-critical-fortigate-flaw/)
- [Critical FortiGate Flaw Exploited to Deploy PivotC2 RAT and Steal Credentials](https://cyberpress.org/critical-fortigate-flaw-exploited/)
- [FortiGate Malware Exploits Critical Firewall Flaw](https://cypro.co.uk/insights/cyber-bulletins/fortigate-malware-exploits-critical-firewall-flaw/)
- [Tenable - CVE-2025-25249](https://www.tenable.com/cve/CVE-2025-25249)
- [FortiOS and FortiSwitchManager Code Execution Vulnerability (CVE-2025-25249)](https://threatprotect.qualys.com/2026/01/14/fortios-and-fortiswitchmanager-code-execution-vulnerability-cve-2025-25249/)
- [Fortinet PSIRT FG-IR-25-084](https://fortiguard.fortinet.com/psirt/FG-IR-25-084)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2431