An improper neutralization of special elements used in an OS command ("OS Command Injection") vulnerability [CWE-78] vulnerability in Fortinet FortiAP 7.6.0 through 7.6.2, FortiAP 7.4.0 through 7.4.5, FortiAP 7.2 all versions, FortiAP 7.0 all versions, FortiAP 6.4 all versions, FortiAP-U 7.0.0 through 7.0.5, FortiAP-U 6.2 all versions, FortiAP-W2 7.4.0 through 7.4.4, FortiAP-W2 7.2 all versions, FortiAP-W2 7.0 all versions allows an authenticated privileged attacker to execute unauthorized code or commands via crafted CLI requests.
| Vendor | Product | Versions |
|---|---|---|
| Fortinet | FortiAP | 7.6.0, 7.4.0, 7.2.0, 7.0.0, 6.4.3, 7.4.0, 7.2.0, 7.0.0, 7.0.0, 6.2.0 |
Downstream vendors/products affected by this vulnerability
| Vendor | Product | Source | Confidence |
|---|---|---|---|
| fortinet | fortiap-w2 | mitre_affected | 90% |
| fortinet | fortiap-u | mitre_affected | 90% |
Updated severity to CRITICAL, added new affected versions 6.4.9, 7.0.7, and 7.2.6, and noted that no patch is currently available.
Updated affected versions and patch availability, and marked exploit availability and active exploitation as true.
Initial creation
