A critical vulnerability in Fortinet’s FortiOS operating system is being actively exploited in the wild to plant a custom-built malware framework on internet-facing firewalls, according to new research from the SOCRadar Threat Research Unit (STRU). The flaw, tracked as CVE-2025-25249 and rated 9.8 out of 10 on the CVSS scale, gives remote, unauthenticated attackers a direct path into vulnerable devices without needing so much as a stolen password.

A Wireless Management Feature Becomes an Open Door

The vulnerability lives in the CAPWAP Control service, the protocol FortiGate appliances use to manage wireless access points, which listens on UDP port 5246. Researchers describe it as a heap-based buffer overflow in the underlying cw_acd daemon: by sending specially crafted packets to that port, an attacker can corrupt memory and ultimately execute their own code on the device. Because CAPWAP is frequently left reachable from the public internet on branch-office and edge firewalls, the attack surface is unusually broad.

The bug affects a wide swath of Fortinet’s install base, including FortiOS versions from 6.4 through 7.6.3 and FortiSwitchManager 7.0.x and 7.2.x. Fortinet has since shipped fixed builds — FortiOS 7.6.4, 7.4.9, 7.2.12, and 7.0.18 or later, along with FortiSwitchManager 7.2.7 and 7.0.6 — but the window between disclosure and patching has already proven costly for hundreds of organizations.

Meet PivotC2: A Purpose-Built Post-Exploitation Toolkit

What makes this campaign notable isn’t just the entry point but what comes after it. Once inside, attackers deploy a custom binary named fortirun.bin, orchestrated through Bash and Python scripts that repeatedly hammer target IP addresses until an exploitation attempt succeeds. That binary drops a compact, single-line JavaScript stager that reaches out to fetch a second-stage payload: a Node.js-based framework the researchers have named PivotC2, currently at version 0.2.3.

PivotC2 is designed to blend in and stay useful long after the initial breach. Rather than accepting inbound connections, which firewall rules would likely block, it calls home over outbound TLS connections — a technique that lets it slip past network defenses configured to watch for unusual inbound traffic. Once established, the toolkit gives operators:

• Interactive remote shells and file transfer capability
• SOCKS5 and HTTP proxying, letting attackers pivot deeper into a network
• Port forwarding for reaching internal-only services
• Fortinet-specific modules that harvest device configuration files and extract stored credentials, decrypting them using AES-256-CBC and AES-128-GCM

The framework also includes what SOCRadar calls an “auto-mode”: a five-stage automated pipeline that lets a single operator scan for, exploit, and seed persistence across large numbers of vulnerable devices with minimal manual effort — effectively industrializing what used to be a manual post-compromise process.

Hundreds of Devices Already Compromised

SOCRadar’s telemetry paints a sobering picture of the campaign’s reach. Researchers observed scanning activity against more than 30,000 FortiGate IP addresses, with 178 devices confirmed compromised so far. The United States accounts for the largest share of infections, followed by Chile, Colombia, and the United Kingdom. Two of the U.S. cases have escalated beyond simple firewall compromise into full internal network intrusions, suggesting the attackers are selectively pursuing high-value targets rather than opportunistically hitting everything they can reach.

Based on Russian-language artifacts left in the code, apparent use of AI-assisted tooling during development, and a clear focus on exfiltrating data from backup and storage infrastructure, researchers assess the group behind PivotC2 is a financially motivated, Russian-speaking cybercrime operation rather than a nation-state actor — though the line between the two has grown increasingly blurry in recent campaigns.

What Defenders Should Do Now

Organizations running any of the affected FortiOS or FortiSwitchManager builds should treat this as an emergency patching event rather than routine maintenance. SOCRadar and Fortinet recommend:

• Upgrading immediately to a fixed FortiOS or FortiSwitchManager build listed above
• Restricting or disabling exposure of the CAPWAP Control port to the public internet wherever wireless management from the internet isn’t strictly required
• Rotating all locally stored credentials on affected devices, including SSL-VPN, LDAP, and IPsec pre-shared keys, since PivotC2 is specifically built to extract and decrypt them
• Hunting for indicators of compromise such as unexpected Node.js processes, the presence of a file at /tmp/.i.js, and outbound TLS connections to unfamiliar infrastructure

Edge devices like firewalls sit at the perimeter precisely because they’re trusted to keep attackers out — which is exactly what makes a critical, unauthenticated flaw in one of them so valuable to criminal groups, and so urgent to patch.