CVE-2023-26210

CWE-78 — OS Command Injection4 documents4 sources

Severity

7.8HIGH

EPSS

0.1%

top 65.24%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Fortinet Fortiadc Fortinet Fortiadcmanager Fortinet Fortiadc Manager

Timeline

PublishedJun 13

Description

Multiple improper neutralization of special elements used in an os command ('OS Command Injection') vulnerabilties [CWE-78] vulnerability in Fortinet allows a local authenticated attacker to execute arbitrary shell code as `root` user via crafted CLI requests.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9

Affected Packages4 packages

▶CVEListV5fortinet/fortiadc7.1.0 — 7.1.1+8

▶NVDfortinet/fortiadc5.2.0 — 5.2.8+10

▶CVEListV5fortinet/fortiadcmanager6.2.0 — 6.2.1+7

▶NVDfortinet/fortiadc_manager10 versions+9

🔴Vulnerability Details

GHSA

GHSA-mhr4-7gpq-rjpw: Multiple improper neutralization of special elements used in an os command ('OS Command Injection') vulnerabilties [CWE-78] in Fortinet FortiADCManage↗2023-06-13

▶

CVEList

CVE-2023-26210: Multiple improper neutralization of special elements used in an os command ('OS Command Injection') vulnerabilties [CWE-78] vulnerability in Fortinet↗2023-06-13

▶

📋Vendor Advisories

Fortinet

Multiple improper neutralization of special elements used in an os command ('OS Command Injection') vulnerabilties [CWE-...↗2023-06-13

▶