Loading vulnerability…
Stack-based Buffer Overflow in FortiManager fgtupdates Service
CVE-2025-54820 is a stack-based buffer overflow vulnerability in the FortiManager fgtupdates service. It affects FortiManager 7.4.0 through 7.4.2, 7.2.0 through 7.2.10, and all 6.4 versions. A remote unauthenticated attacker may be able to trigger the flaw by sending crafted requests to the exposed service when fgtupdates is enabled. The vulnerability can lead to execution of unauthorized commands, and available reporting indicates the attack path may potentially be developed toward remote code execution. Exploitation complexity is increased because successful compromise depends on bypassing stack protection mechanisms present on the target.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can allow a remote unauthenticated attacker to execute unauthorized commands on the affected FortiManager system. Because the flaw is a memory corruption issue in a network-reachable management service, compromise could plausibly result in remote code execution on the appliance, creating risk of full device compromise, abuse of the management plane, and follow-on access to managed infrastructure.
If you can’t patch tonight, do this now.
If immediate patching is not possible, disable the fgtupdates service to remove the exposed attack surface. Restrict service exposure by removing fgtupdates from interface service access where feasible, limit network reachability to trusted administration paths only, audit enabled services on FortiManager, and monitor for anomalous access attempts targeting the update service.
Patch, then assume compromise.
Upgrade affected FortiManager installations to fixed releases. Reported fixed versions include FortiManager 7.4.3 or later and 7.2.11 or later. Deployments on the 6.4 branch should be migrated to a supported fixed release. Vendor-supplied security updates should be applied as the primary remediation.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
9 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.