CVE-2024-40587
An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability [CWE-78] in Fortinet FortiVoice version 7.0.0 through 7.0.4 and before 6.4.9 allows an authe
Severity
Medium 6.3
CVSS 3.1
Exploited
Not listed
EPSS
0.006
46.1th percentile
Discovered by
Not disclosed
Published
Jan 14, 2025
Assigned by fortinet
Description
An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability [CWE-78] in Fortinet FortiVoice version 7.0.0 through 7.0.4 and before 6.4.9 allows an authenticated privileged attacker to execute unauthorized code or commands via crafted CLI requests.
Weakness: CWE-78
Affected products
| Vendor | Product | Category | Matched by |
|---|---|---|---|
| Fortinet | FortiVoice | Other Products | cna-assigner |
Vendor-reported affected versions (1)
- Fortinet · FortiVoice
Vendor remediation
Please upgrade to FortiVoice version 7.2.0 or above Please upgrade to FortiVoice version 7.0.5 or above Please upgrade to FortiVoice version 6.4.10 or above