CVE-2025-53679

published 2025-12-09

CVE-2025-53679: An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability [CWE-78] vulnerability in Fortinet FortiSandbox…

high 7.2 CVSS 3.1

AV N AC L PR H UI N S U C H I H A H

An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability [CWE-78] vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.2, FortiSandbox 4.4.0 through 4.4.7, FortiSandbox 4.2 all versions, FortiSandbox 4.0 all versions, FortiSandbox Cloud 24.1, FortiSandbox Cloud 23 all versions allows a remote privileged attacker to execute unauthorized code or commands via crafted HTTP or HTTPS requests.

Affected

13 ranges

Vendor	Product	Version range	Fixed in
fortinet	fortinet	—	—
fortinet	fortisandbox	—	—
fortinet	fortisandbox	>= 4.0.0 < 4.4.8	4.4.8
fortinet	fortisandbox	4.0.0 – 4.0.6	—
fortinet	fortisandbox	4.2.1 – 4.2.8	—
fortinet	fortisandbox	4.4.0 – 4.4.7	—
fortinet	fortisandbox	>= 5.0.0 < 5.0.3	5.0.3
fortinet	fortisandbox	5.0.0 – 5.0.2	—
fortinet	fortisandbox_cloud	—	—
fortinet	fortisandbox_cloud	—	—
fortinet	fortisandbox_cloud	—	—
fortinet	fortisandbox_cloud	>= 23.1.4245 < 23.4.4374	23.4.4374
fortinet	fortisandboxcloud	—	—

CWE-78