FortiSandbox CVE-2025-53949

Exploitation requires the attacker to (1) have network reachability to the FortiSandbox administrative/web management interface and (2) possess valid low-privilege authenticated credentials (PR:L) to that interface, from which a crafted HTTP request injects OS commands. Affected deployments are FortiSandbox 5.0.0 through 5.0.2, 4.4.0 through 4.4.7, and all 4.2 and 4.0 versions. The authentication requirement is the primary limiting factor - this is not remotely exploitable by fully unauthenticated attackers - so realistic risk concentrates where management access is exposed to untrusted networks or where low-privilege accounts are broadly provisioned. No user interaction is required (UI:N), and no special non-default feature toggle is named in the advisory.

This is a credible, elevated-priority issue. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8) describes network-reachable, low-complexity OS command injection requiring only low-privilege authentication, yielding full confidentiality, integrity, and availability impact on the FortiSandbox appliance - consistent with the CWE-78 description of authenticated code execution via crafted HTTP requests. The EPSS score of 17.19% at the 97th percentile is notably high and signals meaningful predicted exploitation likelihood relative to the broader CVE population, reinforcing that this should not be dismissed as high-CVSS-but-low-real-risk. However, the signals are not uniformly alarming: there is NO CISA KEV listing and NO public proof-of-concept referenced, so the elevated EPSS reflects probability modeling rather than confirmed active exploitation. The PR:L requirement is a genuine mitigating factor - an attacker must first obtain valid (even low-privilege) credentials to the FortiSandbox management interface, so exposure is greatest where the management plane is reachable by untrusted or weakly-authenticated users. Net: treat as a prompt-patch item given the high EPSS, full-impact RCE outcome, and Fortinet's history of appliance exploitation, while noting exploitation is gated behind authentication and no in-the-wild activity is currently confirmed.

An attacker who holds low-privilege credentials to the FortiSandbox web/management interface sends a crafted HTTP request that injects OS command metacharacters into a parameter that is passed unsanitized to an underlying system command, achieving arbitrary code execution on the appliance OS. Because FortiSandbox inspects submitted malware, a foothold here can pivot to the broader security monitoring pipeline. No public exploit code was identified at time of analysis, though the high EPSS percentile suggests exploitation is considered likely.