Fortinet has disclosed a heap-based buffer overflow vulnerability in its FortiOS operating system, tracked as CVE-2025-24477 and categorized under CWE-122. This flaw resides in the cw_stad daemon and allows authenticated attackers to execute arbitrary code or commands by sending specially crafted requests. Despite being rated with a CVSSv3 score of medium severity, the potential for privilege escalation poses a significant threat to affected systems, especially in high-security environments.

The vulnerability impacts several FortiOS branches, specifically: FortiOS 7.6 (7.6.0–7.6.1), FortiOS 7.4 (7.4.0–7.4.7), and FortiOS 7.2 (7.2.4–7.2.11). Users are advised to upgrade to FortiOS 7.6.3, 7.4.8, or 7.2.12, respectively. FortiOS 7.0 and 6.4 are not affected. Fortinet has provided a dedicated upgrade tool to help users transition smoothly to secure versions. This vulnerability is tracked under the internal reference FG-IR-25-026 and was disclosed publicly on July 8, 2025, as part of Fortinet’s proactive threat mitigation strategy.

In addition to software vulnerabilities, the flaw affects specific FortiWiFi models when configured as wireless clients. The impacted models include FWF_80F_2R_3G4G_DSL, FWF_80F_2R, FWF_81F_2R_3G4G_DSL, FWF_81F_2R_3G4G_POE, FWF_81F_2R, FWF_81F_2R_POE, FWF_90G_2R, and FWF_91G_2R. Organizations using these devices in wireless client mode should prioritize the upgrade to prevent potential remote exploitation, especially in environments with authenticated internal users.

Though not classified as high severity by CVSS standards, the vulnerability’s ability to enable privilege escalation and command execution by a valid user greatly elevates its real-world impact. Left unpatched, it could lead to unauthorized access, lateral movement within the network, or complete system compromise. Fortinet’s quick response and disclosure highlight the critical need for timely updates, even for moderate-severity issues, as attackers continue to exploit any available vector to gain a foothold in enterprise infrastructure.