CVE-2024-54024
An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability [CWE-78] in Fortinet FortiIsolator before version 2.4.6 allows a privileged attacker with su
Severity
High 7
CVSS 3.1
Exploited
Not listed
EPSS
0.012
65.6th percentile
Discovered by
Vendor
Vendor advisory field
Published
Apr 8, 2025
Assigned by fortinet
Description
An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability [CWE-78] in Fortinet FortiIsolator before version 2.4.6 allows a privileged attacker with super-admin profile and CLI access to execute unauthorized code via specifically crafted HTTP requests.
Weakness: CWE-78
Affected products
| Vendor | Product | Category | Matched by |
|---|---|---|---|
| Fortinet | FortiIsolator | SASE / SSE / Secure Web | cna-assigner |
Vendor-reported products (1)
- Fortinet · FortiIsolator
Credit
Internally discovered and reported by Adham El karn of Fortinet Product Security team.
Vendor remediation
Please upgrade to FortiIsolator version 2.4.7 or above