CVE-2025-25249 IBM QRadar · QRadar

Detect Fortinet FortiWeb Heap-Based Buffer Overflow Exploitation (CVE-2025-25249) in IBM QRadar

Detects exploitation attempts and indicators of compromise associated with CVE-2025-25249, a heap-based buffer overflow (CWE-122 / CWE-787 out-of-bounds write) affecting multiple Fortinet products. Listed in the CISA KEV catalog, this vulnerability can be triggered by malformed HTTP/HTTPS requests to affected Fortinet management or proxy interfaces, potentially leading to memory corruption, denial of service, or remote code execution. This detection surfaces anomalous requests, crash/restart telemetry, and post-exploitation activity on affected Fortinet appliances.

MITRE ATT&CK

Tactic
Initial Access Execution

QRadar Detection Query

IBM QRadar (QRadar)
sql 
SELECT sourceip, destinationip, "URL" AS url, QIDNAME(qid) AS event_name, payload, starttime
FROM events
WHERE LOGSOURCETYPENAME(devicetype) ILIKE '%Fortinet%'
AND (
    STRLEN("URL") > 2000
    OR "URL" ILIKE '%\%00%'
    OR "URL" ILIKE '%../%'
    OR payload ILIKE '%segfault%'
    OR payload ILIKE '%core dump%'
    OR payload ILIKE '%daemon crash%'
    OR payload ILIKE '%signal 11%'
    OR payload ILIKE '%heap%'
)
ORDER BY starttime DESC
LAST 24 HOURS
high severity medium confidence

Flags Fortinet appliance events with oversized/malformed URLs or crash-related payload strings tied to CVE-2025-25249 heap overflow.

Data Sources

Fortinet log sourceFirewall events

Required Tables

events

False Positives & Tuning

  • Legitimate long query strings from web applications behind FortiWeb
  • Planned appliance restarts logged with crash-like terminology
  • Scanner traffic producing malformed URLs

Other platforms for CVE-2025-25249

Microsoft Sentinel (KQL) Splunk (SPL) Elastic Security (Elastic) Sumo Logic CSE (Sumo) Google Chronicle (YARA-L) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1Oversized HTTP request to Fortinet management interface

    Expected signal: Fortinet syslog/CEF record with a RequestURL length exceeding 2000 bytes from the test source IP.

  2. Test 2Null-byte and traversal encoded request

    Expected signal: Fortinet log entry containing %00 and ../ sequences in the request URL.

  3. Test 3Simulated Fortinet daemon crash log injection

    Expected signal: Synthetic Fortinet syslog message containing 'signal 11', 'segfault', and 'core dump' strings.

Last updated: 2026-09-10 Research depth: standard
References (4)

Response Playbook

Triage

  1. Confirm the affected Fortinet product and firmware version against FG-IR-25-084 to determine whether it is in the vulnerable range for CVE-2025-25249.
  2. Review the source IP(s) of the malformed/oversized requests and check whether they are known, expected clients or external/unknown addresses; enrich with threat intelligence.
  3. Examine the Fortinet appliance crash/restart logs (httpsd, proxyd, or relevant daemon) to determine whether a crash actually occurred coincident with the suspicious request.
  4. Correlate the timing of the request with any subsequent anomalous administrative logins, configuration changes, or new admin accounts on the appliance.

Containment

  1. Restrict access to the affected Fortinet management/proxy interface to trusted management networks only, and block the identified malicious source IP(s) at the perimeter.
  2. Apply the vendor patch from FG-IR-25-084 immediately or, if patching is not yet possible, disable the affected exposed service/interface as a temporary mitigation.
  3. If compromise is suspected, isolate the appliance from untrusted networks and route traffic through a redundant/backup device where available.

Evidence Collection

  1. Capture and preserve the full Fortinet appliance syslog, crash logs, and any core dumps generated around the event for forensic analysis.
  2. Export the raw HTTP request payloads and packet captures targeting the appliance to document the exploitation attempt.

Escalation Criteria

  • !Escalate to incident response if a daemon crash is confirmed together with subsequent unauthorized configuration changes, new admin accounts, or outbound connections from the appliance.
  • !Escalate to the security leadership and vendor (Fortinet PSIRT) if the appliance is internet-facing and confirmed running a vulnerable firmware version with active exploitation observed.

Investigation Guide

Related Techniques

[object Object][object Object]

Forensic Artifacts

  • >Fortinet appliance crash logs and core dumps for httpsd/proxyd daemons
  • >Syslog entries showing daemon restarts and memory faults
  • >Configuration change audit logs and admin session records post-event

Tuning Guidance

Baseline the normal maximum URL/request length for applications behind FortiWeb/FortiProxy to set an appropriate length threshold and reduce false positives from legitimate large payloads. Whitelist known vulnerability scanners and maintenance windows where planned daemon restarts occur. Prioritize alerts where a malformed/oversized request is immediately followed by a crash event from the same source IP.

Hunting Queries

Hunts for clusters of Fortinet daemon crash/restart events over time that may indicate repeated exploitation attempts against CVE-2025-25249.

Hunting — KQL
kql 
CommonSecurityLog | where DeviceVendor == "Fortinet" | where Message has_any ("segfault", "core dump", "daemon crash", "signal 11") | summarize count() by DestinationIP, bin(TimeGenerated, 1h)
Hunting — SPL
spl 
index=fortinet vendor="Fortinet" (msg="*segfault*" OR msg="*core dump*" OR msg="*daemon crash*") | timechart span=1h count by dest_ip

Atomic Red Team Tests

Test 1 Oversized HTTP request to Fortinet management interface
linux

Sends an HTTP request with an extremely long URL to a lab Fortinet appliance to simulate a malformed request that triggers the length-based detection.

Command

bash 
python3 -c "import urllib.request; urllib.request.urlopen('https://fortinet-lab.local/' + 'A'*3000)" || true

Cleanup

bash 
echo 'No cleanup required; request is stateless'

Expected Telemetry

Fortinet syslog/CEF record with a RequestURL length exceeding 2000 bytes from the test source IP.

Expected Detection

KQL/SPL rules fire on RequestLength > 2000 to a Fortinet appliance.

Test 2 Null-byte and traversal encoded request
linux

Sends a request containing null-byte and path-traversal encodings to a lab appliance to simulate malformed input associated with the overflow trigger.

Command

bash 
curl -k "https://fortinet-lab.local/api/v2/%00../%2e%2e/config" || true

Cleanup

bash 
echo 'No cleanup required'

Expected Telemetry

Fortinet log entry containing %00 and ../ sequences in the request URL.

Expected Detection

Detection rules match the malformed URL regex patterns (%00, ../).

Test 3 Simulated Fortinet daemon crash log injection
linux

Injects a synthetic Fortinet daemon crash syslog message into a lab SIEM forwarder to validate crash-indicator detection logic.

Command

bash 
logger -n siem-lab.local -P 514 -t fortinet 'date=2026-09-10 devname=FortiWeb-LAB msg="httpsd daemon crash: signal 11 (segfault), core dump written"'

Cleanup

bash 
echo 'No cleanup required; log entry is synthetic'

Expected Telemetry

Synthetic Fortinet syslog message containing 'signal 11', 'segfault', and 'core dump' strings.

Expected Detection

Detection rules match crash-indicator keywords in the message/payload field.

Related Detections

Tactic Hubs

TA0001Initial AccessTA0002Execution

Related Techniques

T1190Exploit Public-Facing ApplicationT1499Endpoint Denial of Service

Same Tactic: Initial Access

Popular Detections