CVE-2023-34986

published 2023-10-10

CVE-2023-34986: A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWLM version 8.6.0 through 8.6.5 and 8.5.0 through…

Priority P2 65 high 8.8 CVSS 3.1

AV N AC L PR L UI N S U C H I H A H

A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWLM version 8.6.0 through 8.6.5 and 8.5.0 through 8.5.4 allows attacker to execute unauthorized code or commands via specifically crafted HTTP get request parameters.

Affected

4 ranges

Vendor	Product	Version range	Fixed in
fortinet	fortinet	—	—
fortinet	fortiwlm	—	—
fortinet	fortiwlm	8.5.0 – 8.5.4	—
fortinet	fortiwlm	8.6.0 – 8.6.5	—

Detection & IOCs extracted from sources · hover to see the quote

• → CVE-2023-34986 is exploited via specially crafted HTTP GET request parameters targeting Fortinet FortiWLM; monitor for anomalous or shell-metacharacter-containing GET parameters on FortiWLM management interfaces ↗
• → Affected versions are FortiWLM 8.6.0–8.6.5 and 8.5.0–8.5.4; flag traffic to/from unpatched FortiWLM instances running these versions ↗
• → Vulnerability class is OS Command Injection (CWE-78); inspect HTTP GET query strings for OS command injection patterns (e.g., semicolons, pipes, backticks, $() constructs) directed at FortiWLM endpoints ↗

• · This CVE is one of a cluster of related OS command injection vulnerabilities in FortiWLM (CVE-2023-34985 through CVE-2023-34989); detections and patches should account for all five CVEs in this advisory ↗

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-78