Description
An improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiSwitch version 7.4.0 and 7.2.0 through 7.2.5 and 7.0.0 through 7.0.7 and 6.4.0 through 6.4.13 and 6.2.0 through 6.2.7 and 6.0.0 through 6.0.7 allows attacker to execute unauthorized code or commands via the FortiSwitch CLI.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Fortinet | FortiSwitch | 7.4.0, 7.2.0 – ≤ 7.2.5, 7.0.0 – ≤ 7.0.7, 6.4.0 – ≤ 6.4.13, 6.2.0 – ≤ 6.2.7, 6.0.0 – ≤ 6.0.7 | — |
Advisories 2
- NCSC-2025-0018 Kwetsbaarheden verholpen in Fortinet FortiSwitch, FortiManager, FortiAnalyzer, FortiOS en FortiProxy NCSC-NL (Netherlands) · Jan 15, 2025
- WID-SEC-2025-0069 Fortinet FortiSwitch: Mehrere Schwachstellen ermöglichen Codeausführung BSI CERT-Bund (WID) · Jan 14, 2025