# CVE-2025-64157: Fortinet FortiOS format string vulnerability in CAPWAP fast-failover mode

Source: https://junglewise.ai/threats/cve-2025-64157-fortinet-fortios-format-string-vulnerability-in-capwap-fast  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-02-10. Updated: 2026-05-12  
License: CC BY 4.0 with a link back

CVE-2025-64157 · Severity: medium · CVSS 6.7 · Published 2026-02-10

A vulnerability in Fortinet's FortiOS operating system, used in FortiGate firewalls and Siemens industrial application platforms, could allow an administrator to execute unauthorized commands. By providing a specially crafted configuration, a user with high-level access can bypass intended security restrictions to run arbitrary code. This could lead to a full compromise of the device's integrity and availability, though it requires the attacker to already have administrative credentials.

Technologies: [Fortinet FortiGate NGFW](https://junglewise.ai/threats/technologies/fortigate-ngfw), [Fortinet FortiOS](https://junglewise.ai/threats/technologies/fortios), [Siemens Ruggedcom Ape1808](https://junglewise.ai/threats/technologies/ruggedcom-ape1808). Vendors: [Fortinet](https://junglewise.ai/threats/vendors/fortinet), [Siemens](https://junglewise.ai/threats/vendors/siemens).

## Quick answers

**Is CVE-2025-64157 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-64157 being exploited in the wild.

**How severe is CVE-2025-64157?** Medium severity, with a CVSS score of 6.7, published 10 February 2026.

**Which products and versions are affected?** Fortinet FortiGate NGFW Versions with FortiOS < 7.4.10; Fortinet FortiOS 7.6.0 through 7.6.4, 7.4.0 through 7.4.9, 7.2.0 through 7.2.11, 7.0 all versions; Siemens Ruggedcom Ape1808 Versions with FortiOS < 7.4.10.

**Is there a fix for CVE-2025-64157?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2025-64157 attacked?** It is attacked with local access, in an operating system.

**Am I affected by CVE-2025-64157?** Check whether you run Fortinet FortiGate NGFW, Fortinet FortiOS or Siemens Ruggedcom Ape1808 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A Use of Externally-Controlled Format String vulnerability (CWE-134) exists in the CAPWAP fast-failover mode component of FortiOS. The flaw is accessible via the Command Line Interface (CLI) and is triggered when the system processes specifically crafted configuration data. An attacker with administrative privileges can exploit this to achieve arbitrary code execution on the underlying operating system. The vulnerability affects multiple major versions of FortiOS (7.0, 7.2, 7.4, and 7.6) and is also present in Siemens RUGGEDCOM APE1808 devices running affected FortiOS versions. Patches are available in FortiOS 7.6.5, 7.4.10, and subsequent releases.

## Affected products

- Fortinet FortiOS 7.6.0 through 7.6.4, 7.4.0 through 7.4.9, 7.2.0 through 7.2.11, 7.0 all versions
- Siemens RUGGEDCOM APE1808 (Fortigate NGFW) Versions with FortiOS < 7.4.10

## Timeline

- 2026-02-10: disclosed: Initial publication by Fortinet
- 2026-02-10: advisory: Fortinet advisory FG-IR-25-795 published
- 2026-03-10: advisory: Siemens advisory SSA-975644 published

## References

- [https://fortiguard.fortinet.com/psirt/FG-IR-25-795](https://fortiguard.fortinet.com/psirt/FG-IR-25-795)
- [https://cert-portal.siemens.com/productcert/html/ssa-975644.html](https://cert-portal.siemens.com/productcert/html/ssa-975644.html)

## Related threats

- [Fortinet FortiOS authentication bypass in HA command execution](https://junglewise.ai/threats/cve-2026-126259-a-missing-authentication-for-critical-function-vulnerability-in)
- [Fortinet FortiOS stack buffer overflow in WAD proxy](https://junglewise.ai/threats/cve-2026-126258-a-stack-based-buffer-overflow-vulnerability-in-fortinet-fortios)
- [Fortinet FortiOS out-of-bounds read in kernel](https://junglewise.ai/threats/cve-2026-126256-a-out-of-bounds-read-vulnerability-in-fortinet-fortios-8-0-0)
- [Fortinet FortiOS path traversal authentication bypass in SSH daemon](https://junglewise.ai/threats/cve-2026-126255-a-path-traversal-filedir-vulnerability-in-fortinet-fortios-8-0-0)
- [Fortinet FortiOS numeric truncation error in BGP daemon](https://junglewise.ai/threats/cve-2026-126254-a-numeric-truncation-error-vulnerability-in-fortinet-fortios-8-0)