Introduction
Remote access gateways are a primary way into enterprise networks, and flaws in their SSL VPN implementations have repeatedly led to serious security incidents. Fortinet's SSL VPN products are deployed in organizations of every size, so any flaw in their authentication or protocol handling logic is a high priority for defenders.
Fortinet is a global cybersecurity vendor. Its FortiGate firewalls, FortiOS operating system, FortiProxy secure web gateways, and FortiPAM privileged access management products are used by thousands of enterprises, service providers, and government agencies worldwide. The company is a leader in the network security appliance market, and its products often sit at the core of critical infrastructure.
Technical information
CVE-2025-57740 is a heap-based buffer overflow (CWE-122) in the RDP bookmark connection feature of Fortinet's SSL VPN implementation. The flaw is present in FortiOS, FortiPAM, and FortiProxy. An authenticated user triggers it by sending specially crafted requests while an RDP bookmark connection is being set up through the SSL VPN web portal. The vulnerable code does not check the bounds of input data tied to RDP bookmark parameters closely enough, so attacker-controlled data can overflow the allocated heap buffer. That can corrupt adjacent memory and may allow unauthorized code to run with the privileges of the affected process.
The vulnerability requires authenticated access to the SSL VPN portal, so an attacker must first obtain valid credentials. Once authenticated, the attacker can exploit it remotely over the network. The flaw is in the handling of RDP bookmark data, which the SSL VPN interface uses to configure and start Remote Desktop Protocol sessions. No public code snippets or proof-of-concept exploit are available for this vulnerability.
Patch information
Fortinet has fixed the buffer overflow in the fgfmd daemon in updated releases of FortiOS, FortiProxy, FortiPAM, and FortiSwitchManager. The flaw, classified as CWE-124, could allow remote attackers to execute arbitrary code or commands by sending specially crafted packets to the fgfmd daemon.
Fortinet recommends upgrading to the following versions:
-
FortiOS:
- 7.4.4 or later
- 7.2.8 or later
- 7.0.15 or later
-
FortiProxy:
- 7.4.4 or later
- 7.2.10 or later
- 7.0.17 or later
-
FortiPAM:
- 1.3.0 or later
-
FortiSwitchManager:
- 7.2.4 or later
- 7.0.4 or later
For upgrade paths and more detail, see Fortinet's Product Security Incident Response Team (PSIRT) advisory.
Affected systems and versions
-
FortiOS:
- 7.6.2 and below
- 7.4.7 and below
- 7.2.10 and below
- All 7.0 versions
- All 6.4 versions
-
FortiPAM:
- 1.5.0
- 1.4.2 and below
- All 1.3 versions
- All 1.2 versions
- All 1.1 versions
- All 1.0 versions
-
FortiProxy:
- 7.6.2 and below
- 7.4.3 and below
- All 7.2 versions
- All 7.0 versions
The vulnerability is present when SSL VPN is enabled and RDP bookmarks are configured. Only authenticated users can trigger the flaw.
Vendor security history
Fortinet has had several critical vulnerabilities in its SSL VPN implementations in recent years, including CVE-2022-42475 and CVE-2023-27997. Both were heap-based buffer overflows that allowed code execution. Fortinet usually patches supported versions promptly, but customers on unsupported branches have to migrate. The repeated memory-safety bugs in SSL VPN components suggest that Fortinet's secure development and code review processes still need work.
