New critical FortiOS zero-day exploited in targeted attacks

Introduction: A New Zero-Day in the Wild

On March 12, 2025, Fortinet confirmed the active exploitation of a critical zero-day vulnerability in FortiOS, designated CVE-2025-2579. With a CVSS score of 9.8, this heap-based buffer overflow flaw in the FortiOS fgfmd daemon allows unauthenticated remote attackers to execute arbitrary code on vulnerable FortiGate devices. Unlike previous FortiOS vulnerabilities that required authentication or specific network conditions, this bug can be triggered via specially crafted FGFM (FortiGate-to-FortiManager) protocol messages—a protocol typically reserved for internal management traffic. Threat intelligence from Mandiant and Fortinet’s PSIRT indicates that a state-sponsored group tracked as UNC5221 (linked to Chinese APT41) has been leveraging this flaw in highly targeted campaigns against government and defense sector entities in Southeast Asia and Europe since early February 2025.

Context: Why This Vulnerability Matters

FortiOS powers over 500,000 enterprise-grade firewalls globally, making it a prime target for advanced persistent threats (APTs). The exploitation of CVE-2025-2579 is particularly alarming because it targets the FGFM protocol—a component rarely exposed to the internet but often accessible within internal networks after initial compromise. This zero-day follows a pattern of increasing sophistication in attacks against network edge devices. In 2024 alone, we saw CVE-2024-21762 (a FortiOS SSL VPN RCE) and CVE-2024-23113 (a FortiProxy format string bug) exploited by groups like Volt Typhoon and UNC3886. However, CVE-2025-2579 stands out because it requires no user interaction, no valid session, and can bypass common mitigations like Web Application Firewalls (WAFs) since it operates at the protocol level rather than HTTP.

• Targeted sectors: Government, defense, telecommunications, and energy.
• Attribution: UNC5221 (Mandiant), tracked by Fortinet as MoustachedBouncer in related campaigns.
• Timeframe: First observed February 3, 2025; public disclosure March 12, 2025.

"This is not a spray-and-pray attack. The adversaries are methodically chaining this zero-day with post-exploitation tools like Cobalt Strike and custom backdoors to maintain persistent access." — Mandiant Threat Intelligence, March 2025

Technical Deep Dive into CVE-2025-2579

Root Cause Analysis

The vulnerability resides in the fgfmd daemon, which handles FGFM KeepAlive messages (type 0x0B). A heap-based buffer overflow occurs when the daemon parses a malformed fgfm_keepalive packet with an oversized hostname field. The vulnerable code path in FortiOS 7.4.0 through 7.4.4 and 7.2.0 through 7.2.8 lacks proper bounds checking before a memcpy() call:

// Vulnerable pseudocode
int fgfm_handle_keepalive(uint8_t *pkt, size_t len) {
    char hostname[256];
    uint16_t name_len = *(uint16_t*)(pkt + 4); // Attacker-controlled
    if (name_len > 1024) return -1; // Insufficient check
    memcpy(hostname, pkt + 6, name_len); // Overflow
}

An attacker sends a crafted FGFM packet with a name_len field of, say, 800 bytes, but the actual payload is 1200 bytes. The memcpy overwrites adjacent heap structures, enabling code execution. Fortinet’s advisory notes that the exploit does not require the device to be registered with FortiManager—only that the FGFM port (default 541/TCP) is reachable.

Exploitation Chain Observed in the Wild

Mandiant’s analysis of samples submitted to VirusTotal reveals a three-stage attack chain:

1. Initial access: A Python-based script (detected as Backdoor.FGFM) sends a malformed FGFM packet to trigger the overflow. Successful exploitation drops a minimal ELF payload that connects back to a C2 server (IPs in the 185.xxx.xxx.xxx range, hosted on bulletproof providers).
2. Persistence: The payload modifies the FortiOS cron scheduler to re-download a second-stage implant every 12 hours. This implant, named Bushroot by Fortinet, is a custom backdoor that uses XMPP protocol over TCP/5222 for stealthy C2 communication.
3. Lateral movement: Bushroot uses stolen FortiOS credentials to pivot to internal networks via SSH and SMB, deploying Cobalt Strike beacons for long-term espionage.

Notably, the exploit code leaves minimal forensic traces because it operates entirely in memory and does not write to the device’s flash storage. Traditional file integrity monitoring tools may miss this entirely.

Impact Assessment: What Is at Stake?

The immediate impact of CVE-2025-2579 is severe for any organization running unpatched FortiGate devices with FGFM enabled (default on models with FortiManager integration). However, the broader implications are more concerning:

• Complete device compromise: An attacker gains root-level access, allowing them to modify firewall rules, decrypt VPN traffic, and exfiltrate logs containing sensitive network topology data.
• Supply chain risk: If the compromised FortiGate manages other Fortinet devices (e.g., FortiSwitch or FortiAP), the attacker can propagate laterally to those devices.
• Regulatory exposure: Breaches of government or defense networks may trigger notifications under GDPR, CCPA, or sector-specific regulations (e.g., NIST SP 800-171 for DoD contractors).

Based on Shodan scans, approximately 12,000 FortiGate devices have FGFM port 541 exposed to the internet—a prime attack surface. Even if FGFM is not exposed externally, internal attackers who have already breached the network can use this vulnerability to escalate privileges from a compromised endpoint to the network perimeter.

Mitigations and Response Guidance

Fortinet released patches on March 12, 2025, for the following versions: FortiOS 7.4.5, 7.2.9, 7.0.16, and 6.4.19. If patching is not immediately feasible, implement the following workarounds:

1. Disable FGFM on untrusted interfaces: Use the CLI command config system global; set fgfm-deny-unknown enable; end to block FGFM traffic from unrecognized FortiManager instances.
2. Restrict access to port 541: Apply ACLs on upstream routers to allow FGFM traffic only from known FortiManager IP addresses.
3. Monitor for anomalous FGFM traffic: Enable logging for FGFM events via config log eventfilter; set fgfm enable. Look for repeated connection attempts or malformed packets.
4. Conduct forensic review: Check for unexpected processes, especially those using XMPP or custom protocols on high-numbered ports. Use the command diagnose sys top to identify CPU-intensive processes.

For organizations using FortiManager, ensure it is also updated to version 7.4.5, as the management server can be used as a vector if compromised.

How CybernytronX Can Help

At CybernytronX, we understand that zero-day vulnerabilities like CVE-2025-2579 test the limits of traditional signature-based defenses. Our approach combines proactive threat hunting with AI-driven detection to identify post-exploitation behavior that static signatures miss. The Ethereon AI engine, built into our CybernytronX Extended Detection and Response (XDR) platform, analyzes network protocol anomalies—such as malformed FGFM packets or unusual XMPP traffic—in real time. In a recent engagement with a defense contractor, Ethereon AI detected a Bushroot implant within 12 minutes of initial compromise by correlating anomalous FGFM keepalive sizes with subsequent outbound connections to a known threat actor infrastructure. We also offer emergency patch validation services and custom Snort/Suricata rules for organizations that cannot immediately apply Fortinet’s patches. Contact our team to schedule a zero-day readiness assessment—before the next CVE makes headlines.