High severity · published Jun 13, 2023
CVE-2023-26210
Multiple improper neutralization of special elements used in an os command ('OS Command Injection') vulnerabilties [CWE-78] vulnerability in Fortinet allows a local authenticated…
7.8
CVSS
0.5%
EPSS
No
On KEV
Description
Multiple improper neutralization of special elements used in an os command ('OS Command Injection') vulnerabilties [CWE-78] vulnerability in Fortinet allows a local authenticated attacker to execute arbitrary shell code as `root` user via crafted CLI requests.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 41% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FO
Fortiadc · Fortinet
5.2.0 through 5.2.8; 5.3.0 through 5.3.7; 5.4.0 through 5.4.5; 6.0.0 through 6.0.4; 6.1.0 through 6.1.6; 6.2.0 through 6.2.6; +5 more · source: NVD
FM
Fortiadc Manager · Fortinet
5.2.0; 5.2.1; 5.3.0; 5.4.0; 6.0.0; 6.1.0; +4 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-26210
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-26210
Vendor Advisory
https://fortiguard.com/psirt/FG-IR-23-076
More from Fortiadc
4.3
CVE-2018-13374
Fortinet FortiOS and FortiADC Improper Access Control Vulnerability
9.8
CVE-2022-38381
An improper handling of malformed request vulnerability [CWE-228] exists in FortiADC 5.0 all versions, 6.0.0 all versions, 6.1.0 all versions, 6.2.0 through 6.2.3, and 7.0.0…
9.1
CVE-2023-25603
A permissive cross-domain policy with untrusted domains vulnerability in Fortinet FortiADC 7.1.0 - 7.1.1, FortiDDoS-F 6.3.0 - 6.3.4 and 6.4.0 - 6.4.1 allow an unauthorized…
8.8
CVE-2023-26205
An improper access control vulnerability [CWE-284] in FortiADC automation feature 7.1.0 through 7.1.2, 7.0 all versions, 6.2 all versions, 6.1 all versions may allow an…
8.8
CVE-2022-35849
An improper neutralization of special elements used in an OS command vulnerability [CWE-78] in the management interface of FortiADC 7.1.0 through 7.1.1, 7.0.0 through 7.0.3, 6.2.0…