Introduction
An out-of-bounds write in the FortiOS CAPWAP daemon lets an attacker who controls a managed edge device execute arbitrary code on the central FortiGate appliance. FortiGate devices are typically the primary security gateway for enterprise networks. That makes this vulnerability (CVE-2025-53844, CVSS 8.8) a serious escalation path from a compromised access point or switch to full control of the network's security enforcement point.
Technical Information
The vulnerability is classified as CWE-787 (Out-of-bounds Write) and sits in the CAPWAP daemon within FortiOS. CAPWAP (Control And Provisioning of Wireless Access Points) is the protocol FortiGate uses to manage connected wireless access points and other edge devices such as FortiAP, FortiExtender, and FortiSwitch units.
The attack has several preconditions. First, the attacker must gain control of an authenticated device that the target FortiGate manages. That device could be a FortiAP wireless access point, a FortiExtender WAN extender, or a FortiSwitch network switch. These devices maintain authenticated CAPWAP sessions with the FortiGate controller.
Once the attacker controls such a device, they can craft malicious CAPWAP packets and send them to the FortiGate's CAPWAP daemon. The daemon does not properly validate bounds when it writes data from these packets, which produces the out-of-bounds write. Successful exploitation lets the attacker execute unauthorized code or commands on the FortiGate device itself.
The device-level authentication requirement means this cannot be exploited through unauthenticated internet scanning. It does, however, leave two scenarios with significantly elevated risk. The first is an insider threat, where an attacker already has access to managed infrastructure. The second is a supply chain or lateral movement attack, where an edge device (such as a FortiAP deployed in a less physically secure location) is compromised first and then used as a pivot point to attack the central FortiGate appliance.
Because FortiGate devices typically sit at the network perimeter and enforce security policy for the entire environment, code execution on one is a significant escalation of access. Perimeter defenses alone are not enough when the threat comes from a compromised managed device inside the trust boundary.
Fortinet has assigned this vulnerability a CVSSv3 score of 8.3 (High), while the NVD lists a CVSS score of 8.8. The difference likely comes from how each scored the authentication and access complexity requirements.
Affected Systems and Versions
The following FortiOS versions are confirmed vulnerable:
| FortiOS Branch | Affected Versions | Fixed Version |
|---|---|---|
| FortiOS 7.6 | 7.6.0 through 7.6.3 | 7.6.4 or above |
| FortiOS 7.4 | 7.4.0 through 7.4.8 | 7.4.9 or above |
| FortiOS 7.2 | 7.2.0 through 7.2.11 | 7.2.12 or above |
The vulnerability requires two things: the CAPWAP daemon (wireless controller) must be enabled, and managed devices such as FortiAP, FortiExtender, or FortiSwitch units must be connected to the FortiGate. Environments that do not use these managed device types, or that have the wireless controller disabled, are not exposed to this attack vector.
Organizations that cannot patch immediately can use a temporary workaround from Fortinet that disables the CAPWAP daemon:
config global
config system global
set wireless-controller disable
end
This disrupts all wireless controller functionality, so use it only as a stopgap.
Vendor Security History
CVE-2025-53844 is not the first critical memory corruption vulnerability in the FortiOS CAPWAP daemon. In November 2025, Fortinet disclosed a stack-based overflow in the same component (FG-IR-25-358) that also allowed a remote authenticated attacker to execute arbitrary code. Repeated memory safety issues in this one daemon indicate that the CAPWAP implementation is a complex attack surface that has not yet been fully hardened. Given this pattern, security teams managing Fortinet infrastructure should treat CAPWAP-related advisories with particular urgency.
