CVE-2023-36547

published 2023-10-10

CVE-2023-36547: A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWLM version 8.6.0 through 8.6.5 and 8.5.0 through…

Priority P2 70 critical 9.8 CVSS 3.1

AV N AC L PR N UI N S U C H I H A H

A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWLM version 8.6.0 through 8.6.5 and 8.5.0 through 8.5.4 allows attacker to execute unauthorized code or commands via specifically crafted http get request parameters.

Affected

4 ranges

Vendor	Product	Version range	Fixed in
fortinet	fortinet	—	—
fortinet	fortiwlm	—	—
fortinet	fortiwlm	8.5.0 – 8.5.4	—
fortinet	fortiwlm	8.6.0 – 8.6.5	—

Detection & IOCs extracted from sources · hover to see the quote

• → Vulnerability is triggered via crafted HTTP GET request parameters containing OS command injection payloads targeting Fortinet FortiWLM ↗
• → Target affected versions: FortiWLM 8.6.0–8.6.5 and 8.5.0–8.5.4; monitor or block HTTP GET requests with shell metacharacters in parameters to these appliances ↗
• → CWE-78 (OS Command Injection) — inspect HTTP GET query string parameters for shell metacharacters (e.g., ;, |, &&, $(), backticks) destined for FortiWLM management interfaces ↗
• → CVSS 9.8 Critical with no authentication implied — treat any unauthenticated HTTP GET traffic to FortiWLM as high-priority for inspection ↗

• · Multiple related CVEs share the same advisory (FG-IR-23-140); ensure detections cover the full CVE cluster and not just CVE-2023-36547 in isolation ↗
• · Affected products span both 'FortiWLM' and 'FortiWlm' naming variants; ensure asset inventory and detection rules account for both naming conventions ↗

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-78