EUVD-2025-209803
GHSA-rq62-f8qm-52r7
Severity by source
AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
3DescriptionCVE.org
An improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiAP 7.6.0 through 7.6.2, FortiAP 7.4.0 through 7.4.5, FortiAP 7.2 all versions, FortiAP 7.0 all versions, FortiAP 6.4 all versions, FortiAP-W2 7.4.0 through 7.4.4, FortiAP-W2 7.2 all versions, FortiAP-W2 7.0 all versions may allow an authenticated attacker to execute unauthorized code or commands via a specifically crafted cli command.
AnalysisAI
OS command injection in Fortinet FortiAP and FortiAP-W2 access points allows authenticated administrators to execute arbitrary code or commands via specially crafted CLI commands. Affected versions span FortiAP 6.4 through 7.6.2 and FortiAP-W2 7.0 through 7.4.4. The vulnerability requires high-privilege administrative access and does not require user interaction, making it exploitable by rogue administrators or accounts with compromised credentials. No public exploit code or active exploitation has been identified at time of analysis.
Technical ContextAI
The vulnerability stems from improper neutralization of special elements in OS command construction (CWE-78), a classic command injection flaw where user-supplied input from CLI commands is not properly sanitized before being passed to system shell execution. The affected products are Fortinet's FortiAP series (wireless access points) and FortiAP-W2 variant, which process administrative CLI input. The flaw exists in the command parser that accepts CLI operations from authenticated users with high privilege levels (PR:H in CVSS), allowing injection of shell metacharacters or command separators to break out of intended command context and execute arbitrary OS-level operations with the privileges of the FortiAP process.
RemediationAI
Fortinet has released patched versions for FortiAP and FortiAP-W2; administrators must upgrade to FortiAP 7.6.3 or later for the 7.6 branch, 7.4.6 or later for the 7.4 branch, or verify latest patched versions in the 7.2 and 7.0 branches via the Fortinet advisory. Until patches can be deployed, implement the following compensating controls: restrict CLI access to FortiAP devices only to trusted network segments and disable remote CLI access if not required for operations. Enforce strong, unique administrative credentials and implement multi-factor authentication for administrative accounts if the FortiAP platform supports it. Monitor CLI command logs for unusual or suspicious commands, particularly those containing shell metacharacters or escape sequences. Limit the number of administrator accounts with full CLI privileges using the principle of least privilege - create role-based access controls that grant only necessary permissions. These controls introduce operational friction (monitoring overhead, potential latency from MFA) but substantially reduce the likelihood of unauthorized command injection exploitation. Consult the Fortinet PSIRT advisory at https://fortiguard.fortinet.com/psirt/FG-IR-26-133 for the most current patch versions and detailed upgrade procedures.
Fortinet FortiWeb contains a relative path traversal allowing unauthenticated attackers to execute administrative comman
FortiOS and FortiProxy contain an authentication bypass via the Node.js websocket module allowing unauthenticated remote
Fortinet FortiWeb contains an authenticated OS command injection allowing privilege escalation to execute unauthorized c
Fortinet FortiAnalyzer before 5.0.12 and 5.2.x before 5.2.5; FortiSwitch 3.3.x before 3.3.3; FortiCache 3.0.x before 3.0
Buffer overflow in the Cookie parser in Fortinet FortiOS 4.x before 4.1.11, 4.2.x before 4.2.13, and 4.3.x before 4.3.9
A product has a SQL injection vulnerability enabling unauthenticated database compromise through improperly neutralized
Remote code execution in Fortinet FortiClientEMS versions 7.4.5 through 7.4.6 allows unauthenticated attackers to execut
An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability [CWE-78] in
Fortinet FortiAnalyzer and FortiManager contain a critical authentication bypass vulnerability (CVE-2026-24858, CVSS 9.8
Authentication bypass in Fortinet FortiOS, FortiProxy, and FortiSwitchManager allows unauthenticated remote attackers to
The Gzip file parser in AVG Anti-Virus 10.0.0.1190, Bitdefender 7.2, Command Antivirus 5.2.11.5, Emsisoft Anti-Malware 5
The TAR file parser in AhnLab V3 Internet Security 2011.01.18.00, Avira AntiVir 7.11.1.163, Antiy Labs AVL SDK 2.0.3.7,
Same weakness CWE-78 – OS Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today