CVE-2025-24477: Fortinet Vulnerability FG-IR-25-026

Key Takeaways

• CVE-2025-24477 is a heap-based buffer overflow vulnerability in the cw_stad daemon of FortiOS.
• Exploitation requires authenticated, high-privilege access and applies under specific device and configuration conditions.
• The vulnerability affects specific FortiWiFi models when configured as wireless clients.
• Current affected FortiOS branches include 7.2.4 through 7.2.12, 7.4.0 through 7.4.7, and 7.6.0 through 7.6.2.
• Organizations should verify their model, configuration, and firmware version and update to an approved patched release where applicable.
• Logically Managed Service Customers with active support agreements benefit from controls designed to limit administrative access to managed appliances.

On July 8, 2025, Fortinet released PSIRT advisory FG-IR-25-026, detailing CVE-2025-24477, a heap-based buffer overflow vulnerability in the cw_stad daemon of FortiOS. While vulnerabilities always warrant attention, this particular issue is considered low priority for most organizations because it can only be exploited by an authenticated attacker and only under specific conditions.

What Is Logically Doing About CVE-2025-24477?

Given that this vulnerability requires authenticated access, Logically is committed to maintaining the highest standards of security by ensuring that only trusted and authorized users have accounts on our managed devices.

What Are We Asking of Our Valued Clients?

If you are a Managed Service Customer with an active support agreement with Logically for your Fortinet appliance and are operating on an affected firmware version, please be assured that Logically enforces strict security best practices, including limiting administrative access to your appliances.

For clients not currently covered under a Logically Managed Firewall agreement but operating an affected device, we are still here to assist you. Please contact your Account Manager to arrange a comprehensive security review of your appliance. We can help you assess and implement best practices to mitigate vulnerabilities, with services available at our standard billable rates.

What Is CVE-2025-24477?

CVE-2025-24477 is a heap-based buffer overflow vulnerability in the FortiOS cw_stad daemon.

• Vulnerability: Heap-based buffer overflow (CWE-122)
• Component: FortiOS cw_stad daemon
• Impact: An authenticated attacker with high privileges may be able to escalate privileges through a specially crafted command.
• Discovery: Internally reported by Fortinet’s own security team.

Who Is Actually at Risk From CVE-2025-24477?

This vulnerability has a limited attack surface:

• Only certain FortiWiFi models are affected, and only when set up as a wireless client.
• Exploitation requires authenticated access, meaning an attacker must already have valid credentials for the device.

Which Fortinet Products Are Affected?

The following products may be affected when configured as a wireless client:

• FWF_80F_2R_3G4G_DSL
• FWF_80F_2R
• FWF_81F_2R_3G4G_DSL
• FWF_81F_2R_3G4G_POE
• FWF_81F_2R
• FWF_81F_2R_POE
• FWF_90G_2R
• FWF_91G_2R

The affected wireless-client models are also documented in vulnerability analysis based on Fortinet’s advisory.

Which FortiOS Versions Are Affected?

Current vulnerability records identify the following affected versions:

• FortiOS 7.2.4 through 7.2.12
• FortiOS 7.4.0 through 7.4.7
• FortiOS 7.6.0 through 7.6.2

Which FortiOS Versions Contain the Fix?

Patched versions include:

• FortiOS 7.2.13+
• FortiOS 7.4.8+
• FortiOS 7.6.3+

What Actions Should Organizations Take?

For most organizations, this vulnerability represents a low-priority concern. Nonetheless, it remains best practice to ensure that all devices are consistently updated to approved and supported firmware versions, alongside regular reviews of device configurations to maintain optimal security posture.

• Check if you’re affected: Are you running one of the listed models as a wireless client, and are you on an affected firmware version?
• No wireless client? If your device isn’t configured as a wireless client, you’re not impacted.
• No authenticated attackers? If you have strong credential management and access controls, the risk is minimal.

Why Is CVE-2025-24477 Considered Lower Priority for Most Organizations?

The vulnerability is considered lower priority for most organizations because exploitation requires authenticated access and applies only to specific device configurations.

• Exploitation requires valid credentials.
• Only applies to specific device models and configurations.
• Public vulnerability records do not currently list CVE-2025-24477 in the CISA Known Exploited Vulnerabilities catalog.

How Can Organizations Stay Secure?

Even low-priority vulnerabilities are worth addressing as part of your regular maintenance cycle.

• Review device configurations.
• Monitor Fortinet PSIRT advisories for future updates.

For more technical details, see the official Fortinet PSIRT Advisory FG-IR-25-026.

What Is the Bottom Line on CVE-2025-24477?

If you are operating a FortiOS device configured as a wireless client on an affected version, please ensure that access is strictly limited to authorized users. For most environments, however, this vulnerability poses minimal risk.

Updated September 2026

By Logically VP of Cybersecurity, Zack Finstad

FAQs

What is CVE-2025-24477?

CVE-2025-24477 is a heap-based buffer overflow vulnerability in the FortiOS cw_stad daemon.

Who is at risk from CVE-2025-24477?

This vulnerability has a limited attack surface:

• Only certain FortiWiFi models are affected, and only when set up as a wireless client.
• Exploitation requires authenticated access, meaning an attacker must already have valid credentials for the device.

What should organizations do about CVE-2025-24477?

For most organizations, this vulnerability represents a low-priority concern. Nonetheless, it remains best practice to ensure that all devices are consistently updated to approved and supported firmware versions, alongside regular reviews of device configurations to maintain optimal security posture.

Why is CVE-2025-24477 considered lower priority for most organizations?

The vulnerability is considered lower priority for most organizations because exploitation requires authenticated access and applies only to specific device configurations.

What is the bottom line on CVE-2025-24477?

If you are operating a FortiOS device configured as a wireless client on an affected version, please ensure that access is strictly limited to authorized users. For most environments, however, this vulnerability poses minimal risk.