cbcvebase.
CVE-2025-53679
published 2025-12-09

CVE-2025-53679: An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability [CWE-78] vulnerability in Fortinet FortiSandbox…

PriorityP264high7.2CVSS 3.1
AVNACLPRHUINSUCHIHAH
EPSS
11.20%
95.5th percentile
An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability [CWE-78] vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.2, FortiSandbox 4.4.0 through 4.4.7, FortiSandbox 4.2 all versions, FortiSandbox 4.0 all versions, FortiSandbox Cloud 24.1, FortiSandbox Cloud 23 all versions allows a remote privileged attacker to execute unauthorized code or commands via crafted HTTP or HTTPS requests.

Affected

13 ranges
VendorProductVersion rangeFixed in
fortinetfortinet——
fortinetfortisandbox——
fortinetfortisandbox>= 4.0.0 < 4.4.84.4.8
fortinetfortisandbox4.0.0 – 4.0.6—
fortinetfortisandbox4.2.1 – 4.2.8—
fortinetfortisandbox4.4.0 – 4.4.7—
fortinetfortisandbox>= 5.0.0 < 5.0.35.0.3
fortinetfortisandbox5.0.0 – 5.0.2—
fortinetfortisandbox_cloud——
fortinetfortisandbox_cloud——
fortinetfortisandbox_cloud——
fortinetfortisandbox_cloud>= 23.1.4245 < 23.4.437423.4.4374
fortinetfortisandboxcloud——

Detection & IOCsextracted from sources · hover to see the quote

  • →Target attack surface is the GUI backup options endpoint in FortiSandbox, reachable via crafted HTTP or HTTPS requests from a remote privileged attacker ↗
  • →Vulnerability class is OS Command Injection (CWE-78) in FortiSandbox GUI backup options — monitor for anomalous OS command execution spawned from the FortiSandbox web process ↗
  • ·Affected versions: FortiSandbox 5.0.0–5.0.2, 4.4.0–4.4.7, 4.2 all versions, 4.0 all versions; FortiSandbox Cloud 24.1 and Cloud 23 all versions — ensure patching covers all branches ↗
  • ·Exploitation requires a remote privileged (authenticated) attacker — restrict administrative access to FortiSandbox GUI to trusted networks/IPs as a compensating control ↗
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.