Description
A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiManager Cloud 7.6.0 through 7.6.1, FortiManager Cloud 7.4.0 through 7.4.4, FortiManager Cloud 7.2.2 through 7.2.7, FortiManager 7.6.0 through 7.6.1, FortiManager 7.4.0 through 7.4.5, FortiManager 7.2.1 through 7.2.8 may allow an authenticated remote attacker to execute unauthorized code via FGFM crafted requests.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Fortinet | FortiManager | 7.6.0 – ≤ 7.6.1, 7.4.0 – ≤ 7.4.5, 7.2.1 – ≤ 7.2.8 | — |
| Fortinet | FortiManager Cloud | 7.4.1 – ≤ 7.4.4, 7.2.2 – ≤ 7.2.7 | — |
Advisories 2
- NCSC-2025-0018 Kwetsbaarheden verholpen in Fortinet FortiSwitch, FortiManager, FortiAnalyzer, FortiOS en FortiProxy NCSC-NL (Netherlands) · Jan 15, 2025
- WID-SEC-2025-0087 Fortinet FortiManager: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jan 14, 2025