# Fortinet FortiOS/FortiPAM/FortiProxy/FortiSwitchManager CLI Path Traversal Privilege Escalation (CVE-2025-61624) Exploited by UNC5820 to Deploy PEERSTITCH

> CVE-2025-61624 is a path traversal flaw (CWE-22) in the FortiOS-family CLI that lets an authenticated administrator write or delete arbitrary files, escalating to root. CISA added it to KEV on 2026-10-16, and Palo Alto Unit 42 reports UNC5820 (CL-STA-0954) used it to deploy the memory-resident PEERSTITCH implant on FortiGate firewalls.

- **Published:** 2026-10-20T02:59:08Z
- **Last reviewed:** 2026-10-20T02:59:08Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3921
- **ID:** TL-2026-3921
- **Severity:** MEDIUM (CVSS 6)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Actor:** UNC5820
- **Detections:** 9 · **IOCs:** 22 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2025-61624, CVE-2024-47575, CVE-2024-26008

## Description

CVE-2025-61624 is an Improper Limitation of a Pathname to a Restricted Directory (CWE-22) weakness in the command line interpreter of FortiOS, FortiPAM, FortiProxy and FortiSwitchManager. An authenticated attacker with an admin profile and at least read-write permissions can write or delete arbitrary files through specifically crafted arguments to existing CLI commands, enabling security restriction bypass, data manipulation and elevation of privilege. Fortinet (FG-IR-26-122, published 2026-04-14, internally discovered) scores it CVSS 3.1 6.0 (AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H, temporal 5.4); NVD scores it 6.5 (AV:N). Fortinet lists it as known exploited and ships a virtual patch signature (FG-VD-59270.0day, FMWP db update 25.120).

Unit 42 (published 2026-10-14) documents the exploitation: in the FortiOS CLI system.auto-script engine, '../' traversal sequences in the auto-script object name let the attacker place the script body at any filesystem location and have it run with elevated privileges, giving root on the underlying firewall OS. Observed traversal script names include '../../../../setup' and '../../tmp/apache2/conf/md-acme.conf'.

The activity is attributed to UNC5820 (tracked by Palo Alto Networks as CL-STA-0954), which Unit 42 describes as showing complex tradecraft overlapping with intrusions attributed to suspected nation-state actors. The victim was a telecommunications managed service provider compromised in September 2024 via FortiManager CVE-2024-47575 (FortiJump), which Mandiant reported exploited since 2024-06-27. The actor registered a rogue virtual FortiGate, used CVE-2024-26008 to terminate authentic FortiManager sessions, and exfiltrated configuration data covering more than 500 managed FortiGate firewalls, including credentials, configurations and cryptographic material. After an extended dwell period, CVE-2025-61624 was used to reach root and deploy PEERSTITCH.

PEERSTITCH is an ARM64 statically linked Linux ELF, delivered as a five-file chain (pM.js, index.js, index.wasm, ipssem.js, and the native lldprx binary) fetched from attacker-hosted HTTP servers on port 8085. It is memory-resident with no persistent binary on disk: a one-shot injector patches the running /bin/miglogd and /bin/iked daemons, writing a 1,344-byte payload into a 16,384-byte RWX buffer, applies NOP patches (0xAA0003E0) to suppress tamper checks and a 20-byte trampoline to redirect execution. It builds a covert inter-process bridge between the two daemons via /proc/<pid>/mem, keyed on a marker in traffic (TCP 8550, 169.254.0.1), and opens no listening ports and makes no outbound connections of its own. Unit 42 also describes abuse of the Apache mod_md ACME DNS-01 flow to obtain an SSH reverse shell.

Siemens SSA-975644 (2026-03-10, updated 2026-05-12) separately lists CVE-2025-61624 as affecting RUGGEDCOM APE1808 running Fortinet NGFW 7.4.10. HKCERT (2026-10-20) rates it Medium and states it is exploited in the wild, citing Fortinet and CISA. No public PoC was found in the sources reviewed. BeaconBeagle lookups for the two payload-hosting IPs returned HTTP 404, so no C2 correlation could be recorded.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1059 Command and Scripting Interpreter
- T1548 Abuse Elevation Control Mechanism
- T1055 Process Injection
- T1055 Process Injection
- T1036 Masquerading
- T1685 Disable or Modify Tools
- T1040 Network Sniffing
- T1602 Data from Configuration Repository
- T1071 Application Layer Protocol

## Sources

- [HKCERT: Fortinet Products Elevation of Privilege Vulnerability](https://www.hkcert.org/security-bulletin/fortinet-products-elevation-of-privilege-vulnerability_20261020)
- [Fortinet PSIRT FG-IR-26-122](https://fortiguard.fortinet.com/psirt/FG-IR-26-122)
- [NVD: CVE-2025-61624](https://nvd.nist.gov/vuln/detail/CVE-2025-61624)
- [CISA KEV Catalog entry for CVE-2025-61624](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-61624)
- [Unit 42: PEERSTITCH, a Stealthy FortiGate Implant](https://unit42.paloaltonetworks.com/fortimanager-cve-2024-47575-peerstitch-malware/)
- [SecurityWeek: Exploited Fortinet Bug Linked to Stealthy FortiGate Implant in Telecom Hack](https://www.securityweek.com/exploited-fortinet-bug-linked-to-stealthy-fortigate-implant-in-telecom-hack/)
- [Siemens SSA-975644 (RUGGEDCOM APE1808)](https://cert-portal.siemens.com/productcert/html/ssa-975644.html)
- [SentinelOne Vulnerability Database: CVE-2025-61624](https://www.sentinelone.com/vulnerability-database/cve-2025-61624/)
- [BleepingComputer: Mandiant says new Fortinet FortiManager flaw has been exploited since June](https://www.bleepingcomputer.com/news/security/mandiant-says-new-fortinet-fortimanager-flaw-has-been-exploited-since-june/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3921