PEERSTITCH Malware Delivered via FortiOS Path‑Traversal Flaw (CVE‑2025‑61624) Bypasses VPN Session Checks
What It Is – A newly‑identified ARM64 memory‑resident malware family, PEERSTITCH, is being dropped by threat actors who exploit a path‑traversal bug (CVE‑2025‑61624) in Fortinet’s FortiOS, FortiPAM, FortiProxy and FortiSwitchManager.
Exploitability – The vulnerability has a CVSS 5.4 score and is already observed in the wild; proof‑of‑concept code and active exploitation reports are public.
Affected Products – FortiOS (all supported versions), FortiPAM, FortiProxy, FortiSwitchManager.
Why It Matters for Trust & Control Assurance
- Continuous vulnerability monitoring and rapid patch deployment are essential control objectives; a gap here erodes the audit trail that regulators and enterprise buyers demand.
- Demonstrable evidence that all network‑infrastructure assets are running approved, non‑vulnerable firmware satisfies multiple framework controls (e.g., NIST CSF Identify and Protect, ISO 27001 A.12.6).
- Mapping the remediation of CVE‑2025‑61624 to a single control objective provides a “one‑to‑many” compliance signal across SOC 2, PCI DSS, GDPR, etc.
Recommended Actions
- Apply Fortinet’s latest security patches for CVE‑2025‑61624 immediately.
- Verify that VPN session tagging checks are re‑enabled and that no unauthorized binaries remain on the appliance.
- Update your vulnerability‑management process to capture patch‑status evidence as continuous control‑assurance artifacts.
- Map the remediation to the “secure configuration & vulnerability remediation” control objective in your framework of record.
Source: The Hacker News – FortiOS Flaw Exploited to Deploy PEERSTITCH Malware