CVE-2024-21756 — OS Command Injection in Fortinet Fortisandbox

CWE-78 — OS Command Injection8 documents6 sources
Severity
8.8HIGHNVD
EPSS
1.0%
top 22.48%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Fortinet Fortisandbox
Timeline
PublishedApr 9
Latest updateNov 21

Description

A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.3, FortiSandbox 4.2.1 through 4.2.6, FortiSandbox 4.0.0 through 4.0.4 allows attacker to execute unauthorized code or commands via crafted requests..

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages2 packages

▶NVDfortinet/fortisandbox4.0.0 — 4.0.5+2
▶CVEListV5fortinet/fortisandbox4.4.0 — 4.4.3+2

🔴Vulnerability Details

5
OSV
linux-oracle-5.15 vulnerabilities↗2025-04-25
▶
OSV
linux-intel-iot-realtime, linux-realtime vulnerabilities↗2025-04-24
▶
OSV
linux-azure-fips vulnerabilities↗2025-04-24
▶
GHSA
GHSA-q9gh-68qf-6p2r: A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiSandbox version 4↗2024-04-09
▶
CVEList
CVE-2024-21756: A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSandbox 4↗2024-04-09
▶

📋Vendor Advisories

2
Chrome
Long Term Support Channel Update for ChromeOS: CVE-2025-13223↗2025-11-21
▶
Fortinet
OS command injection on endpoint↗2024-04-09
▶
CVE-2024-21756 — OS Command Injection in Fortinet | cvebase