PSIRTHeap-based buffer overflow in cw_stad daemon
Summary
A heap-based buffer overflow vulnerability [CWE-122] in FortiOS cw_stad daemon may allow an authenticated attacker to execute arbitrary code or commands via specifically crafted requests.
| Version | Affected | Solution |
|---|---|---|
| FortiOS 7.6 | 7.6.0 through 7.6.2 | Upgrade to 7.6.3 or above |
| FortiOS 7.4 | 7.4.0 through 7.4.7 | Upgrade to 7.4.8 or above |
| FortiOS 7.2 | 7.2.4 through 7.2.12 | Upgrade to 7.2.13 or above |
| FortiOS 7.0 | Not affected | Not Applicable |
| FortiOS 6.4 | Not affected | Not Applicable |
The following models are impacted if configured as a as a wireless client :
- FWF_80F_2R_3G4G_DSL
- FWF_80F_2R
- FWF_81F_2R_3G4G_DSL
- FWF_81F_2R_3G4G_POE
- FWF_81F_2R
- FWF_81F_2R_POE
- FWF_90G_2R
- FWF_91G_2R
Acknowledgement
Internally discovered and reported by Gwendal Guégniaud of Fortinet Product Security team.Timeline
2025-07-08: Initial publication2025-11-03: changed fixed version from 7.2.12 to 7.2.13