Fortinet FortiAP EUVD-2025-209803

Exploitation requires authentication as a high-privilege (administrative) user on the Fortinet FortiAP or FortiAP-W2 device. The attacker must have direct access to the device's CLI interface via SSH, HTTPS web console, or local serial connection (local attack vector). No special FortiAP configuration or feature enablement is documented as a prerequisite; the vulnerability exists in the default CLI command processing. Exploitation is limited to authenticated users with high administrative privileges (PR:H) and does not affect unauthenticated users or users with lower privilege levels. Non-default configurations such as role-based access control (RBAC) that restrict CLI access could limit the pool of users who can exploit this, but do not eliminate the vulnerability itself.

This vulnerability presents moderate real-world risk constrained by strict exploitation conditions. The CVSS 6.7 score reflects the severity: local attack vector (AV:L), low complexity (AC:L), and high-impact outcomes (C:H/I:H/A:H). However, the PR:H (high privilege required) requirement significantly limits the attack surface - exploitation requires an authenticated administrator account or lateral movement to such an account. The absence of network accessibility (AV:L) further restricts remote exploitation paths; an attacker cannot directly trigger this from the network and instead must either compromise an admin account or conduct insider abuse. The scope is unchanged (S:U), indicating impact is limited to the affected system. No KEV listing, no public POC, and no EPSS score data are available, suggesting this is not currently being actively exploited at scale. Organizations with strong administrative access controls and credential hygiene face lower risk; those with weak admin account practices or shared credentials face higher risk. The real-world priority depends on deployment context: FortiAP access points in enterprise environments typically have restricted admin access, but in smaller deployments or managed service environments where credentials are shared, risk increases.

A malicious insider or attacker who has compromised administrative credentials logs into the FortiAP device via SSH or HTTPS management interface. The attacker crafts a CLI command that includes shell metacharacters (such as semicolons, pipes, or backticks) to inject additional OS commands, such as executing a reverse shell, modifying system files, or disabling security features. The FortiAP parser fails to sanitize the input, passes the crafted command directly to the OS shell, and the injected commands execute with the privileges of the FortiAP daemon, allowing the attacker to gain unauthorized control of the access point.