Introduction
Remote code execution on a perimeter firewall can let attackers bypass network defenses, pivot into internal systems, and disrupt business operations. CVE-2025-58413 is a significant risk for organizations that rely on Fortinet FortiOS and FortiSASE, because it lets unauthenticated attackers execute arbitrary code via network packets.
Fortinet is a major cybersecurity vendor, best known for its FortiGate firewalls and the FortiOS operating system. It has millions of devices deployed worldwide across enterprises, service providers, and critical infrastructure, so a vulnerability in its products can affect a very large number of organizations.
Technical information
CVE-2025-58413 is a stack-based buffer overflow, classified under CWE-121. The flaw is in the network packet processing logic of Fortinet FortiOS and FortiSASE. When the system receives specially crafted packets, it does not properly validate input length before it copies data into a stack-allocated buffer. An attacker can then overwrite stack memory, including return addresses and local variables, hijack control flow, and execute arbitrary code or commands with the privileges of the affected process. The attack does not require authentication, so any exposed system is a potential target.
The vulnerability affects core networking components, but public advisories do not name the specific function or code path. No public code snippets, proof-of-concept exploits, or detailed technical diagrams are available. Fortinet tracks the issue in advisory FG-IR-25-632. It has a CVSS score of 7.5, which reflects its high severity and how easily it can be exploited.
Affected systems and versions
CVE-2025-58413 affects the following Fortinet products and versions:
- FortiOS 7.6.0 through 7.6.3
- FortiOS 7.4.0 through 7.4.8
- FortiOS 7.2 (all versions)
- FortiOS 7.0 (all versions)
- FortiOS 6.4 (all versions)
- FortiOS 6.2 (all versions)
- FortiOS 6.0 (all versions)
- FortiSASE 25.3.b
Any system running one of these versions is vulnerable if it is exposed to attacker-controlled network traffic. An attacker can trigger the vulnerability remotely, without authentication.
Vendor security history
Fortinet has had several critical vulnerabilities in recent years, including stack-based buffer overflows (such as CVE-2025-32756), heap-based buffer overflows, path traversal, and authentication bypass flaws. Some of these issues were exploited in the wild before public disclosure. Fortinet generally patches promptly once an advisory is published. The company has also been criticized for silent patching and delayed CVE publication, which can delay risk assessment and remediation for customers.
