When the Firewall Becomes the Foothold: CVE-2025-25249 and PivotC2

Attackers are targeting the perimeter itself, and monitoring must keep pace with patching.

A firewall is supposed to be where an organization draws its security boundary. That makes it easy to think of the FortiGate as the control protecting everything behind it.

CVE-2025-25249 challenges that assumption.

The vulnerability is a heap-based buffer overflow in the cw_acd daemon used for CAPWAP communications in affected FortiOS and FortiSwitchManager versions. It can allow an unauthenticated remote attacker to execute code on the appliance. Fortinet released fixes for affected versions, but the vulnerability was subsequently exploited in the wild.

Researchers identified an active campaign using the vulnerability to deploy PivotC2, a remote-access trojan designed for FortiGate environments. Campaign reporting identified more than 30,000 targeted addresses and 178 confirmed infections.

A compromised firewall is not just another compromised endpoint. It can become the attacker's position inside the network.

The perimeter is an attractive target

CVE-2025-25249 sits in an important but less obvious part of the FortiGate attack surface: CAPWAP.

CAPWAP is used to manage wireless access points, and the vulnerable cw_acd service processes CAPWAP traffic on UDP port 5246. The reported exploitation path does not require an attacker to authenticate first.

There is also a practical challenge around perimeter patching. Network appliances can require maintenance windows, HA considerations, configuration validation, and coordination with network teams. As a result, a vendor patch being available does not necessarily mean every internet-facing appliance has already been upgraded.

That creates an important detection requirement: assume the vulnerable window can exist, and monitor what happens during it.

PivotC2 changes the detection problem

Exploitation is only the first stage.

PivotC2 provides capabilities including shell access, tunneling, port forwarding, network scanning, and FortiGate configuration and credential harvesting.

That changes what a SOC should look for.

Instead of monitoring only traffic through the firewall, defenders need to ask:

What is the firewall itself communicating with?

The campaign identified malicious infrastructure including 46.151.29[.]58 and 146.103.99[.]177, alongside additional infrastructure associated with the campaign. These indicators are valuable for threat hunting, but they should not be the only detection mechanism.

Attack infrastructure changes. Behavioral signals are harder to replace.

Unexpected external traffic to FortiGate services, unusual FortiGate-originated outbound connections, and connections initiated by the appliance toward internal systems can provide valuable evidence of compromise.

Threat intelligence tells you where attackers have been. Behavioral detection helps identify where they are going next.

How CyberSift detects the attack path

CyberSift created a detection rule specifically for suspicious external traffic targeting FortiGate CAPWAP-related ports 5246–5249:

cybersift.parser.vendor:Fortigate AND DestinationPort:(5246 OR 5247 OR 5248 OR 5249) AND isInternalFlow:false AND NOT action:deny

The rule is an early-warning detection, not proof that PivotC2 is present. An allowed external connection to these ports should trigger investigation and correlation with subsequent activity.

The detection becomes significantly more useful when correlated with FortiGate-originated traffic, including connections to known malicious infrastructure, unusual persistent outbound sessions, or unexpected connections from the FortiGate into internal networks.

The rule is available in the CyberSift detection rules repository.

CyberSift continuously hunts for malicious infrastructure associated with active campaigns. Following the disclosure of the PivotC2 campaign, our SOC proactively hunted for the reported malicious IP addresses across monitored telemetry.

Patching reduces exposure. Continuous monitoring helps determine whether that exposure was already exploited.

Patch the perimeter and hunt the gap

CVE-2025-25249 is a reminder that vulnerability management and detection engineering solve different parts of the same problem.

Affected FortiGate devices should be upgraded to the vendor-recommended fixed versions. At the same time, organizations should investigate whether vulnerable appliances were targeted or compromised before remediation.

The lesson is broader than one CVE or one malware family. Internet-facing security appliances are high-value assets, and their telemetry belongs in the same detection strategy as servers, endpoints, and identity systems.

The perimeter is not outside the threat model. It is part of the threat model.

Explore the CyberSift Sentio SIEM platform or review the CyberSift detection rules to see how emerging threats such as PivotC2 can be turned into actionable detections.

-Written by Stanislav Stoychev