CVE-2024-48891

An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability [CWE-78] in FortiSOAR 7.6.0 through 7.6.1, 7.5.0 through 7.5.1, 7.4 all versions, 7.3 all ve

Severity
Medium 6.6
CVSS 3.1
Exploited
Not listed
EPSS
0.005
38.7th percentile
Discovered by
Third party
Vendor advisory field
Published
Oct 14, 2025
Assigned by fortinet

Description

An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability [CWE-78] in FortiSOAR 7.6.0 through 7.6.1, 7.5.0 through 7.5.1, 7.4 all versions, 7.3 all versions may allow an attacker who has already obtained a non-login low privileged shell access (via another hypothetical vulnerability) to perform a local privilege escalation via crafted commands.

Weakness: CWE-78

Affected products

Vendor Product Category Matched by
Fortinet FortiSOAR SIEM & Log Management cna-assigner
Vendor-reported products (1)
  • Fortinet · FortiSOAR on-premise

Credit

Internally discovered and reported by Boumediene Kaddour from Fortinet FortiGuard labs team. Fortinet is also pleased to thank Lexfo company for reporting this vulnerability under responsible disclosure.

Vendor remediation

Upgrade to FortiSOAR on-premise version 7.6.2 or above Upgrade to FortiSOAR on-premise version 7.5.2 or above

Something wrong here?