Description
A improper neutralization of special elements used in an os command ('os command injection') vulnerability [CWE-78] in Fortinet FortiWeb CLI version 7.6.0 through 7.6.3 and before 7.4.8 allows a privileged attacker to execute arbitrary code or command via crafted CLI commands.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Fortinet | FortiWeb | 7.6.0 – ≤ 7.6.3, 7.4.1 – ≤ 7.4.8 | — |
Advisories 2
- WID-SEC-2025-1805 Fortinet FortiWeb: Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 17, 2025
- NCSC-2025-0255 Kwetsbaarheden verholpen in Fortinet producten NCSC-NL (Netherlands) · Aug 13, 2025