What is the CVSS score of CVE-2025-53679?

CVE-2025-53679 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.7%.

Which versions of Fortinet FortiSandbox are affected by CVE-2025-53679?

Fortinet FortiSandbox and FortiSandbox Cloud (versions 5.0, 4.4, 4.2, 4.0, and Cloud 24.1/23.x) contain an authenticated command injection vulnerability allowing high-privileged administrators to…

How to fix or mitigate CVE-2025-53679?

Within 24 hours: Inventory all FortiSandbox instances and document version numbers; restrict administrative console access to essential personnel with documented business justification. Within 7 days: Contact Fortinet support for patch availability timeline and vulnerability timeline; establish change control process for any admin account access grants. Within 30 days: Apply vendor patches immediately upon release; if unavailable beyond 30 days, implement network segmentation restricting management interface access to dedicated administrative network and deploy enhanced auditing on all administrative actions.

Fortinet FortiSandbox CVE-2025-53679

HIGH

OS Command Injection (CWE-78)

2025-12-09 psirt@fortinet.com

Command Injection Fortinet Fortisandbox Fortisandbox Cloud

7.2

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.2 HIGH

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 01, 2026 - 12:30 vuln.today

CVE Published

Dec 09, 2025 - 18:15 nvd

HIGH 7.2

DescriptionCVE.org

An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability [CWE-78] vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.2, FortiSandbox 4.4.0 through 4.4.7, FortiSandbox 4.2 all versions, FortiSandbox 4.0 all versions, FortiSandbox Cloud 24.1, FortiSandbox Cloud 23 all versions allows a remote privileged attacker to execute unauthorized code or commands via crafted HTTP or HTTPS requests.

AnalysisAI

Authenticated OS command injection in Fortinet FortiSandbox (versions 5.0.0-5.0.2, 4.4.0-4.4.7, all 4.2.x, all 4.0.x) and FortiSandbox Cloud (24.1 and all 23.x) allows a high-privileged remote attacker to execute arbitrary commands by sending crafted HTTP/HTTPS requests to the management interface. No public exploit identified at time of analysis and the issue is not currently listed in CISA KEV, but the breadth of affected major versions and the network-reachable attack surface make this a notable post-authentication risk for security appliance operators.

Technical ContextAI

FortiSandbox is Fortinet's network sandboxing appliance used to detonate suspicious files and URLs to detect advanced threats, exposing a web-based management API over HTTP/HTTPS. The root cause is CWE-78 (Improper Neutralization of Special Elements used in an OS Command), meaning at least one administrative HTTP/HTTPS handler concatenates attacker-controlled input into a shell or system call without proper sanitization or argument-array invocation. The CPE data confirms the flaw resides in the fortisandbox and fortisandbox_cloud product lines across the on-prem 4.0/4.2/4.4/5.0 trains and the 23/24.1 cloud branches, indicating a long-standing code path rather than a regression in a single recent release.

RemediationAI

Patch available per vendor advisory FG-IR-25-454 (https://fortiguard.fortinet.com/psirt/FG-IR-25-454); administrators should consult that page for the exact fixed builds in the 4.4, 5.0, and Cloud 24.1 trains, as the 4.0 and 4.2 branches may require upgrade to a supported major version rather than an in-train patch. Until upgrade is possible, restrict access to the FortiSandbox management HTTP/HTTPS interface to a dedicated management VLAN or jump-host source IPs using trusthost or upstream firewall ACLs, which blocks the network reachability the CVSS vector relies on at the cost of needing to manage admin access paths. Additionally, rotate any shared admin credentials, enforce per-administrator accounts with MFA where supported, and review appliance audit logs for unexpected admin API calls - these reduce the chance that the PR:H precondition is satisfied by an attacker, with the trade-off of operational overhead.