CVE-2024-54018
Multiple improper neutralization of special elements used in an OS Command vulnerabilities [CWE-78] in FortiSandbox before 4.4.5 allows a privileged attacker to execute unauthorized commands via craft
Severity
Medium 6.5
CVSS 3.1
Exploited
Not listed
EPSS
0.100
95.4th percentile
Discovered by
Vendor
Vendor advisory field
Published
Mar 11, 2025
Assigned by fortinet
Description
Multiple improper neutralization of special elements used in an OS Command vulnerabilities [CWE-78] in FortiSandbox before 4.4.5 allows a privileged attacker to execute unauthorized commands via crafted requests.
Weakness: CWE-78
Affected products
| Vendor | Product | Category | Matched by |
|---|---|---|---|
| Fortinet | FortiSandbox | Threat Detection & Sandbox | cna-assigner |
Vendor-reported products (1)
- Fortinet · FortiSandbox
Credit
Internally discovered and reported by Théo Leleu of Fortinet Product Security team.
Vendor remediation
Upgrade to FortiSandbox version 5.0.0 or above Upgrade to FortiSandbox version 4.4.6 or above