# CVE-2025-58413: Fortinet FortiOS stack buffer overflow in CAPWAP daemon

Source: https://junglewise.ai/threats/cve-2025-58413-fortinet-fortios-stack-buffer-overflow-in-capwap-daemon  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-11-18. Updated: 2026-06-09  
License: CC BY 4.0 with a link back

CVE-2025-58413 · Severity: high · CVSS 7.5 · Published 2025-11-18

A security vulnerability exists in the software used to manage wireless access points on Fortinet networking devices. An attacker located on the same local network could potentially take full control of the device by sending malicious data packets. While the attack is difficult to execute because it requires bypassing modern security protections, a successful exploit could lead to unauthorized access to the corporate network or a complete service outage.

Technologies: [Fortinet FortiOS](https://junglewise.ai/threats/technologies/fortios), [Fortinet Fortisase](https://junglewise.ai/threats/technologies/fortisase), [Siemens Ruggedcom Ape1808](https://junglewise.ai/threats/technologies/ruggedcom-ape1808). Vendors: [Fortinet](https://junglewise.ai/threats/vendors/fortinet), [Siemens](https://junglewise.ai/threats/vendors/siemens).

## Quick answers

**Is CVE-2025-58413 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-58413 being exploited in the wild.

**How severe is CVE-2025-58413?** High severity, with a CVSS score of 7.5, published 18 November 2025.

**Which products and versions are affected?** Fortinet FortiOS 7.6.0 through 7.6.3, 7.4.0 through 7.4.8, 7.2 all versions, 7.0 all versions, 6.4 all versions, 6.2 all versions, 6.0 all versions; Fortinet Fortisase 25.3.b; Siemens Ruggedcom Ape1808 All versions with Fortinet NGFW < V7.4.9 or < V7.6.6.

**Is there a fix for CVE-2025-58413?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2025-58413 attacked?** It is attacked from the adjacent network, in an operating system.

**Am I affected by CVE-2025-58413?** Check whether you run Fortinet FortiOS, Fortinet Fortisase or Siemens Ruggedcom Ape1808 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A stack-based buffer overflow vulnerability (CWE-121) exists in the CAPWAP (Control and Provisioning of Wireless Access Points) daemon of Fortinet FortiOS and FortiSASE. The flaw is triggered by processing specially crafted packets sent by an unauthenticated attacker on an adjacent network (same local IP subnet). In default configurations, the attacker must typically control an authorized FortiAP to reach the vulnerable component. Successful exploitation allows for arbitrary code execution, though it requires defeating exploit mitigations such as ASLR and stack canaries. Fortinet has released patches (e.g., FortiOS 7.6.4 and 7.4.9) and provided workarounds including disabling security fabric access on interfaces and removing inter-controller-peer elements.

## Affected products

- Fortinet FortiOS 7.6.0 through 7.6.3, 7.4.0 through 7.4.8, 7.2 all versions, 7.0 all versions, 6.4 all versions, 6.2 all versions, 6.0 all versions
- Fortinet FortiSASE 25.3.b
- Siemens RUGGEDCOM APE1808 All versions with Fortinet NGFW < V7.4.9 or < V7.6.6

## Timeline

- 2025-11-18: advisory: Initial publication by Fortinet
- 2025-11-18: disclosed
- 2025-11-21: other: Workarounds added to Fortinet advisory

## References

- [https://fortiguard.fortinet.com/psirt/FG-IR-25-632](https://fortiguard.fortinet.com/psirt/FG-IR-25-632)
- [https://cert-portal.siemens.com/productcert/html/ssa-864900.html](https://cert-portal.siemens.com/productcert/html/ssa-864900.html)

## Related threats

- [Fortinet FortiOS authentication bypass in HA command execution](https://junglewise.ai/threats/cve-2026-126259-a-missing-authentication-for-critical-function-vulnerability-in)
- [Fortinet FortiOS stack buffer overflow in WAD proxy](https://junglewise.ai/threats/cve-2026-126258-a-stack-based-buffer-overflow-vulnerability-in-fortinet-fortios)
- [Fortinet FortiOS out-of-bounds read in kernel](https://junglewise.ai/threats/cve-2026-126256-a-out-of-bounds-read-vulnerability-in-fortinet-fortios-8-0-0)
- [Fortinet FortiOS path traversal authentication bypass in SSH daemon](https://junglewise.ai/threats/cve-2026-126255-a-path-traversal-filedir-vulnerability-in-fortinet-fortios-8-0-0)
- [Fortinet FortiOS numeric truncation error in BGP daemon](https://junglewise.ai/threats/cve-2026-126254-a-numeric-truncation-error-vulnerability-in-fortinet-fortios-8-0)