Fortiextender Firmware
Monthly
OS command injection in Fortinet FortiExtender firmware lets an attacker who already holds a high-privilege administrative session run arbitrary operating-system commands on the device by sending a crafted HTTP request to the management interface. All builds of 7.0.x and 7.2.x are affected along with 7.4.0 through 7.4.7 and 7.6.0 through 7.6.3, and successful exploitation yields full compromise of confidentiality, integrity, and availability (CVSS 3.1 base 7.2, AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H). Exploitation is gated behind admin authentication, so only administrators or attackers who have already stolen admin credentials/sessions can trigger it; no public exploit code or confirmed active exploitation was identified at time of analysis, and EPSS is 1.71% (77th percentile).
Authenticated local CLI users on affected FortiExtender firmware can trigger a classic buffer overflow by supplying crafted CLI commands, potentially executing arbitrary code or commands with high confidentiality, integrity, and availability impact. The issue affects FortiExtender 7.6.0 through 7.6.1, 7.4.0 through 7.4.6, and all 7.2 and 7.0 versions; exploitation requires valid CLI credentials and local/management-plane access, and no public exploit was identified at time of analysis (EPSS 0.03%, 7th percentile).
A debug messages revealing unnecessary information vulnerability in Fortinet FortiExtender 7.6.0 through 7.6.1, FortiExtender 7.4.0 through 7.4.6, FortiExtender 7.2 all versions, FortiExtender 7.0. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. No vendor patch available.
An improper access control in Fortinet FortiExtender 4.1.1 - 4.1.9, 4.2.0 - 4.2.6, 5.3.2, 7.0.0 - 7.0.4, 7.2.0 - 7.2.4 and 7.4.0 - 7.4.2 allows an attacker to create users with elevated privileges. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
An OS command injection vulnerability in FortiExtender 4.1.0 to 4.1.1, 4.0.0 and below under CLI admin console may allow unauthorized administrators to run arbitrary system level commands via. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
OS command injection in Fortinet FortiExtender firmware lets an attacker who already holds a high-privilege administrative session run arbitrary operating-system commands on the device by sending a crafted HTTP request to the management interface. All builds of 7.0.x and 7.2.x are affected along with 7.4.0 through 7.4.7 and 7.6.0 through 7.6.3, and successful exploitation yields full compromise of confidentiality, integrity, and availability (CVSS 3.1 base 7.2, AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H). Exploitation is gated behind admin authentication, so only administrators or attackers who have already stolen admin credentials/sessions can trigger it; no public exploit code or confirmed active exploitation was identified at time of analysis, and EPSS is 1.71% (77th percentile).
Authenticated local CLI users on affected FortiExtender firmware can trigger a classic buffer overflow by supplying crafted CLI commands, potentially executing arbitrary code or commands with high confidentiality, integrity, and availability impact. The issue affects FortiExtender 7.6.0 through 7.6.1, 7.4.0 through 7.4.6, and all 7.2 and 7.0 versions; exploitation requires valid CLI credentials and local/management-plane access, and no public exploit was identified at time of analysis (EPSS 0.03%, 7th percentile).
A debug messages revealing unnecessary information vulnerability in Fortinet FortiExtender 7.6.0 through 7.6.1, FortiExtender 7.4.0 through 7.4.6, FortiExtender 7.2 all versions, FortiExtender 7.0. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. No vendor patch available.
An improper access control in Fortinet FortiExtender 4.1.1 - 4.1.9, 4.2.0 - 4.2.6, 5.3.2, 7.0.0 - 7.0.4, 7.2.0 - 7.2.4 and 7.4.0 - 7.4.2 allows an attacker to create users with elevated privileges. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
An OS command injection vulnerability in FortiExtender 4.1.0 to 4.1.1, 4.0.0 and below under CLI admin console may allow unauthorized administrators to run arbitrary system level commands via. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.