CVE-2019-15708 — OS Command Injection in Fortinet Fortiap

CWE-78 — OS Command Injection5 documents5 sources
Severity
6.7MEDIUMNVD
EPSS
0.2%
top 53.65%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
7
Fortinet FortiapFortinet Fortiap-sFortinet Fortiap-u+4 more
Timeline
PublishedMar 15
Latest updateMay 24

Description

A system command injection vulnerability in the FortiAP-S/W2 6.2.1, 6.2.0, 6.0.5 and below, FortiAP 6.0.5 and below and FortiAP-U below 6.0.0 under CLI admin console may allow unauthorized administrators to run arbitrary system level commands via specially crafted ifconfig commands.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:HExploitability: 0.8 | Impact: 5.9

Affected Packages7 packages

▶NVDfortinet/fortiap6.0.5
▶NVDfortinet/fortiap-s6.0.5+2
▶NVDfortinet/fortiap-w26.0.5+2
▶CVEListV5fortinet/fortinet_fortiapbelow 6.0.0

🔴Vulnerability Details

2
GHSA
GHSA-2gq5-qf2r-h3gj: A system command injection vulnerability in the FortiAP-S/W2 6↗2022-05-24
▶
CVEList
CVE-2019-15708: A system command injection vulnerability in the FortiAP-S/W2 6↗2020-03-15
▶

💥Exploits & PoCs

1
Exploit-DB
Nagios XI 5.5.6 - Remote Code Execution / Privilege Escalation↗2019-01-23
▶

📋Vendor Advisories

1
Fortinet
A system command injection vulnerability in the FortiAP-S/W2 6.2.1, 6.2.0, 6.0.5 and below, FortiAP 6.0.5 and below and...↗2020-03-15
▶
CVE-2019-15708 — OS Command Injection in Fortinet | cvebase