What is the CVSS score of CVE-2025-57740?

CVE-2025-57740 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of FortiOS are affected by CVE-2025-57740?

Fortinet FortiOS, FortiProxy, and FortiPAM are vulnerable to authenticated remote code execution across multiple major versions (7.6.2, 7.4.7, 7.2.10, and all 6.4/7.0 releases), with no public…

How to fix or mitigate CVE-2025-57740?

Within 24 hours: Inventory all FortiOS, FortiProxy, and FortiPAM deployments and document exact versions, particularly flagging 7.6.2, 7.4.7, 7.2.10, 6.4, and 7.0 series installations. Within 7 days: Restrict network access to RDP functionality on affected devices to only trusted administrative sources; remove or reduce privileges for low-privileged user accounts; disable RDP bookmarks if operationally unnecessary. Within 30 days: Monitor Fortinet security advisories for patch releases; establish patching timeline with vendor; evaluate alternative appliances if timeline becomes unacceptable.

FortiOS CVE-2025-57740

HIGH

Heap-based Buffer Overflow (CWE-122)

2025-10-14 psirt@fortinet.com

Fortinet Heap Overflow Buffer Overflow Fortiproxy Fortipam Fortios

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 09, 2026 - 10:31 vuln.today

CVE Published

Oct 14, 2025 - 16:15 nvd

HIGH 7.5

DescriptionCVE.org

An Heap-based Buffer Overflow vulnerability [CWE-122] in FortiOS version 7.6.2 and below, version 7.4.7 and below, version 7.2.10 and below, 7.0 all versions, 6.4 all versions; FortiPAM version 1.5.0, version 1.4.2 and below, 1.3 all versions, 1.2 all versions, 1.1 all versions, 1.0 all versions and FortiProxy version 7.6.2 and below, version 7.4.3 and below, 7.2 all versions, 7.0 all versions RDP bookmark connection may allow an authenticated user to execute unauthorized code via crafted requests.

AnalysisAI

Authenticated remote code execution in Fortinet FortiOS, FortiProxy, and FortiPAM enables low-privileged users to trigger a heap-based buffer overflow through crafted RDP bookmark connection requests. The flaw affects multiple major release trains across all three product families, including FortiOS 7.6.2 and earlier, 7.4.7 and earlier, 7.2.10 and earlier, and all 6.4/7.0 versions. No public exploit has been identified at time of analysis, and the issue is not listed in CISA KEV.

Technical ContextAI

The vulnerability is a CWE-122 heap-based buffer overflow in the RDP bookmark connection handler shared across FortiOS (the base operating system for FortiGate appliances), FortiProxy (secure web gateway), and FortiPAM (privileged access management). RDP bookmarks are a feature that lets authenticated portal users launch Remote Desktop sessions to internal hosts via the SSL VPN/web portal; the parser for crafted bookmark connection requests fails to bound a write into a heap allocation, allowing adjacent heap metadata or object pointers to be corrupted. Because the same vulnerable code is reused across CPE entries cpe:2.3:o:fortinet:fortios, cpe:2.3:o:fortinet:fortipam, and cpe:2.3:a:fortinet:fortiproxy, a single root cause cascades into all three product lines.

RemediationAI

Patch available per vendor advisory FG-IR-25-756 (https://fortiguard.fortinet.com/psirt/FG-IR-25-756); upgrade FortiOS past 7.6.2 / 7.4.7 / 7.2.10 and migrate off 7.0 and 6.4 trains, upgrade FortiProxy past 7.6.2 / 7.4.3 and migrate off 7.2 and 7.0, and upgrade FortiPAM past 1.5.0 / 1.4.2 and migrate off 1.3 and earlier - refer to the FortiGuard advisory for the exact fixed build numbers per branch. Where immediate patching is not possible, the most direct compensating control is to disable the RDP bookmark feature in the SSL VPN/web portal configuration (config vpn ssl web portal, removing rdp from the bookmarks list), which eliminates the vulnerable code path at the cost of removing browser-based RDP access for legitimate users. Additionally, restrict portal access to trusted source IP ranges via local-in policy and tighten authentication (enforce MFA on all portal accounts) to raise the bar for the PR:L precondition. Siemens-managed OT deployments should also consult SSA-864900 at https://cert-portal.siemens.com/productcert/html/ssa-864900.html for environment-specific guidance.