CVE-2024-21756
published 2024-04-09CVE-2024-21756: A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.3…
PriorityP264high8.8CVSS 3.1
AVNACLPRLUINSUCHIHAH
EPSS
2.18%
80.1th percentile
A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.3, FortiSandbox 4.2.1 through 4.2.6, FortiSandbox 4.0.0 through 4.0.4 allows attacker to execute unauthorized code or commands via crafted requests..
Affected
9 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| fortinet | fortinet | — | — |
| fortinet | fortisandbox | — | — |
| fortinet | fortisandbox | >= 4.0.0 < 4.0.5 | 4.0.5 |
| fortinet | fortisandbox | 4.0.0 – 4.0.4 | — |
| fortinet | fortisandbox | >= 4.2.0 < 4.2.7 | 4.2.7 |
| fortinet | fortisandbox | 4.2.1 – 4.2.6 | — |
| fortinet | fortisandbox | >= 4.4.0 < 4.4.4 | 4.4.4 |
| fortinet | fortisandbox | 4.4.0 – 4.4.3 | — |
| chrome_chrome | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Target product is Fortinet FortiSandbox; look for crafted HTTP requests to FortiSandbox endpoints that contain OS command injection payloads (special shell metacharacters) in request parameters. ↗
- →Vulnerability class is OS Command Injection (CWE-78) on a FortiSandbox endpoint; monitor for anomalous process spawning from FortiSandbox web/API service processes, especially shell child processes. ↗
- ·Affected versions are FortiSandbox 4.4.0–4.4.3, 4.2.1–4.2.6, and 4.0.0–4.0.4. Ensure detection/patching scope covers all three affected branches. ↗
- ·This advisory covers two CVEs (CVE-2024-21755 and CVE-2024-21756) under the same FG-IR-23-489 advisory; both relate to OS command injection on FortiSandbox endpoints and should be treated together for patching and detection purposes. ↗
CVSS provenance
nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
osv7.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Chrome
Long Term Support Channel Update for ChromeOS: CVE-2025-13223
vendor_chrome·2025-11-21·CVSS 7.0
CVE-2025-13223 [HIGH] Long Term Support Channel Update for ChromeOS: CVE-2025-13223
Long Term Support Channel Update for ChromeOS
CVE-2025-13223: Type Confusion in V8. And also CVE-2025-21700, CVE-2025-21703, CVE-2025-21702, CVE-2025-21756, CVE-2025-21971, CVE-2025-21703, CVE-2025-21971, CVE-2025-37798, CVE-2025-37756, CVE-2025-37752, CVE-2025-21836, CVE-2024-27397 Release notes for LTS-138 can be found here Want to know more about Long-term Support? Click here Andy Wu Google Chrome OS
Severity: high
Fortinet
OS command injection on endpoint
vendor_fortinet·2024-04-09·CVSS 8.8
CVE-2024-21755 [HIGH] CWE-78 OS command injection on endpoint
FG-IR-23-489: OS command injection on endpoint
A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.3, FortiSandbox 4.2.1 through 4.2.6, FortiSandbox 4.0.0 through 4.0.4 allows attacker to execute unauthorized code or commands via crafted requests..
CVEs: CVE-2024-21755, CVE-2024-21756
CWEs: CWE-78
CVSS: 8.8 (high)
Affected products: FortiSandbox, Fortinet
OSV
linux-oracle-5.15 vulnerabilities
osv·2025-04-25·CVSS 7.8
CVE-2022-0995 linux-oracle-5.15 vulnerabilities
linux-oracle-5.15 vulnerabilities
Jann Horn discovered that the watch_queue event notification subsystem in
the Linux kernel contained an out-of-bounds write vulnerability. A local
attacker could use this to cause a denial of service (system crash) or
escalate their privileges. (CVE-2022-0995)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- Network drivers;
- File systems infrastructure;
- NTFS3 file system;
- Ethernet bridge;
- Ethtool driver;
- IPv6 networking;
- Network traffic control;
- VMware vSockets driver;
(CVE-2025-21993, CVE-2025-21703, CVE-2024-50248, CVE-2025-21700,
CVE-2024-50256, CVE-2025-21701, CVE-2024-56651, CVE-2025-21756,
CVE-2024-26837
OSV
linux-intel-iot-realtime, linux-realtime vulnerabilities
osv·2025-04-24·CVSS 7.8
CVE-2022-0995 linux-intel-iot-realtime, linux-realtime vulnerabilities
linux-intel-iot-realtime, linux-realtime vulnerabilities
Jann Horn discovered that the watch_queue event notification subsystem in
the Linux kernel contained an out-of-bounds write vulnerability. A local
attacker could use this to cause a denial of service (system crash) or
escalate their privileges. (CVE-2022-0995)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- Network drivers;
- File systems infrastructure;
- NTFS3 file system;
- Ethernet bridge;
- Ethtool driver;
- IPv6 networking;
- Network traffic control;
- VMware vSockets driver;
(CVE-2024-56651, CVE-2025-21756, CVE-2024-26837, CVE-2025-21700,
CVE-2024-46826, CVE-2024-50256, CVE-2024-50248, CVE-202
OSV
linux-azure-fips vulnerabilities
osv·2025-04-24·CVSS 7.8
CVE-2022-0995 linux-azure-fips vulnerabilities
linux-azure-fips vulnerabilities
Jann Horn discovered that the watch_queue event notification subsystem in
the Linux kernel contained an out-of-bounds write vulnerability. A local
attacker could use this to cause a denial of service (system crash) or
escalate their privileges. (CVE-2022-0995)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- Network drivers;
- Microsoft Azure Network Adapter (MANA) driver;
- File systems infrastructure;
- NTFS3 file system;
- Ethernet bridge;
- Ethtool driver;
- IPv6 networking;
- Network traffic control;
- VMware vSockets driver;
(CVE-2024-26837, CVE-2024-50248, CVE-2025-21756, CVE-2025-21701,
CVE-2024-50256, CVE-2025-21993
GHSA
GHSA-q9gh-68qf-6p2r: A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiSandbox version 4
ghsa_unreviewed·2024-04-09
CVE-2024-21756 [HIGH] CWE-78 GHSA-q9gh-68qf-6p2r: A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiSandbox version 4
A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiSandbox version 4.4.0 through 4.4.3 and 4.2.0 through 4.2.6 and 4.0.0 through 4.0.4 allows attacker to execute unauthorized code or commands via crafted requests..
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2024-04-09
Published