CVE-2025-25249: 178 FortiGate Devices Compromised by AI-Built PivotC2 RAT

CVE-2025-25249 is classified as CWE-122 (heap-based buffer overflow) in the cw_acd daemon, a component responsible for managing CAPWAP protocol communication with wireless access points. CAPWAP is a standard protocol defined in RFC 5415 that allows a wireless LAN controller, in this case the FortiGate, to centrally manage connected access points. The cw_acd service listens on UDP port 5246 for incoming CAPWAP control messages.

The overflow occurs when the daemon processes an incoming CAPWAP Discovery Request or Join Request message with a malformed element field that exceeds the allocated heap buffer. The attacker controls the overflow content, which enables a write-what-where primitive sufficient to redirect the instruction pointer into attacker-controlled shellcode. Because the vulnerability is in the CAPWAP listener and not in the web management interface or VPN stack, it bypasses authentication entirely: the service does not validate credentials before processing the message that triggers the overflow.

Fortinet confirmed that patched firmware has been available since early 2026, with the public advisory FG-IR-25-084 published on January 14, 2026. The fix validates the length fields in incoming CAPWAP messages before any heap allocation, preventing the overflow condition. Organizations that applied the January 2026 update are not vulnerable. The 30,000+ devices still on the attacker target list represent deployments where the firmware update was not applied, consistent with the common pattern of delayed patch adoption for network appliances that require scheduled maintenance windows.

If the wireless controller feature is not in use, disabling the CAPWAP listener on UDP 5246 is a viable interim control. This blocks the specific protocol the exploit targets while the organization schedules a firmware update maintenance window. Confirm the listener is disabled by verifying from the FortiGate CLI that no process is bound to UDP 5246 after disabling the wireless controller feature in the system configuration.

PivotC2 is a post-exploitation remote access trojan written in Node.js and designed to run persistently within the FortiOS environment on compromised FortiGate appliances. The choice of Node.js for a firewall-targeted RAT is deliberate: FortiOS ships with JavaScript runtime support for certain management automation features, making Node.js execution less anomalous than a compiled ELF binary introduced from outside. The file lands at /tmp/.i.js and is executed by the attacker's shellcode immediately after gaining code execution via CVE-2025-25249.

PivotC2 provides five primary capabilities on a compromised FortiGate. First, an interactive reverse shell channels commands from the attacker's C2 server through an encrypted connection to the firewall. Second, bidirectional traffic tunneling routes the attacker's network traffic through the FortiGate appliance into the internal network behind it, allowing the attacker to reach internal hosts as if they were on the LAN without any additional compromise. Third, a built-in network scanner enumerates internal IP ranges and open ports using the FortiGate's privileged network position. Fourth, the RAT reads and decrypts stored FortiGate configuration files, extracting VPN credentials, administrator account password hashes, and network topology data. Fifth, harvested browser credentials from the system are exfiltrated to the attacker's C2 servers.

SOCRadar's analysis of PivotC2's code structure concludes the RAT was likely developed with AI assistance. Indicators include consistent code formatting across modules, systematic error handling, and documentation comments that follow a pattern inconsistent with the ad-hoc development common in financially motivated cybercrime tools. This represents a confirmed operational use of AI-assisted malware development, not theoretical. The same campaign that deployed PivotC2 also exfiltrated data from two US-based organizations, demonstrating that AI-developed tooling translates directly to confirmed intrusion outcomes.

Attackers use PivotC2's tunneling capability to make subsequent lateral movement appear to originate from the FortiGate appliance itself. Standard endpoint detection tools monitoring internal network traffic trust traffic from the firewall management IP and are unlikely to flag connections originating from it as malicious. Review your SIEM for lateral movement activity attributed to your FortiGate management or LAN IP addresses.

The CVE-2025-25249 exploitation campaign has been active since at least July 2026. SOCRadar's investigation, triggered by attacker infrastructure analysis, recovered files containing a target list of more than 30,000 FortiGate IP addresses. These are not randomly scanned targets but a curated list of internet-facing FortiGate devices confirmed by the attacker to be running vulnerable FortiOS versions, indicating preparatory reconnaissance before mass exploitation.

Of the 30,000+ targeted devices, 178 confirmed infections have been identified, representing a 0.6% infection rate on the known target list. The highest concentration of compromised devices is in the United States. Two US-based organizations experienced full network intrusions in which attackers used PivotC2's tunneling capability to move beyond the FortiGate into internal networks and exfiltrate data. These are not opportunistic drive-by compromises: the attacker conducted deliberate post-exploitation operations including network mapping, credential harvesting, and data staging before exfiltration.

Attribution assessment identifies the campaign as a Russian-speaking, financially motivated cybercrime operation based on observed tradecraft, C2 infrastructure registration patterns, and operational timing consistent with Eastern European business hours. No nation-state APT designation has been applied. This is the category of threat actor for which ransomware deployment is a common second-stage objective after credential and configuration harvesting from perimeter devices such as the N-able N-central RMM platform exploited in the September 2026 RMM campaign.

The 8-month gap between the January 2026 patch release and the current active exploitation demonstrates a persistent and widely observed pattern: perimeter device firmware updates are systematically deprioritized relative to endpoint and server patching. Network appliances require maintenance windows, vendor support, and configuration validation that extend the patch cycle. Attackers exploit this gap deliberately, selecting CVEs where the patch exists but adoption lags. The same dynamic enabled the Citrix NetScaler authentication bypass campaign earlier this year.

The following indicators are confirmed in the CVE-2025-25249 PivotC2 exploitation campaign. Block the C2 IP addresses at your perimeter immediately, regardless of whether your FortiGate firmware has been patched, as blocking eliminates the attacker's ability to receive data from any already-compromised devices.

To check for post-exploitation artifacts on your FortiGate, connect to the CLI and run: execute shell ls /tmp/.i.js

A returned file path confirms active PivotC2 infection. Immediately isolate the device from network connectivity, preserve a configuration backup, and initiate your incident response process before applying the firmware patch, as patching alone does not remove an already-installed PivotC2 instance.

These rules detect two distinct phases of the CVE-2025-25249 attack chain. The network-layer rule targets the CAPWAP exploitation attempt at UDP port 5246 using Zeek connection logs; deploy on any network tap positioned in front of FortiGate appliances. The C2 communication rule detects outbound connections from any internal host to the confirmed PivotC2 command-and-control IPs; deploy on any SIEM receiving network flow data.

Requirements: Zeek network logs with conn.log ingested to SIEM for Rule 1. Network flow data (NetFlow, sFlow, or firewall traffic logs) for Rule 2. Both rules carry status experimental and should be validated against your environment before promotion to a production alert. Block the two C2 IPs at your perimeter firewall regardless of detection rule deployment status.

Apply the patch from Fortinet PSIRT advisory FG-IR-25-084 to the appropriate patched version for your FortiOS branch. The CISA mandatory remediation deadline is September 12, 2026. If you cannot patch before that deadline, apply the interim controls below immediately to reduce exposure while scheduling a maintenance window.

Remediation steps, in order:

The CVE-2025-25249 PivotC2 campaign illustrates the core structural problem with perimeter device patch management: network appliances are consistently patched months later than servers and endpoints, and attackers build target lists specifically from unpatched perimeter device inventory. The January 2026 Fortinet patch was not a surprise. The active exploitation in July 2026 was also not a surprise. The 30,000-device target list is a direct measurement of how many organizations have not yet closed this gap.

FortiGate firewalls are among the most widely deployed network security appliances globally. CVE-2025-25249 is not a complex supply chain attack or a novel technique. It is a straightforward heap overflow in a well-understood protocol component. The PivotC2 RAT that follows is sophisticated, but it only matters if the initial access step succeeds. Applying the January 2026 patch closes the door.

The two confirmed US network intrusions with data exfiltration in this campaign serve as the concrete stakes. A compromised FortiGate is not a single compromised device. It is a compromised network perimeter with a persistent, trusted-position pivot into everything behind it. PivotC2's tunneling capability means that every internal network segment reachable from the FortiGate LAN interface is reachable by the attacker through a channel your internal detection tools will see as originating from your own firewall.

The September 12 CISA deadline applies to federal agencies but the threat is not sector-limited. If your FortiGate is on the 30,000-device target list, the remediation deadline is not September 12. It is before the next automated exploitation attempt runs against your appliance.