CVE-2024-54024
An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability [CWE-78] in Fortinet FortiIsolator before version 2.4.6 allows a privileged attacker with su
Severity
High 7
CVSS 3.1
Exploited
Not listed
EPSS
0.011
63.1th percentile
Discovered by
Not disclosed
Published
Apr 8, 2025
Assigned by fortinet
Description
An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability [CWE-78] in Fortinet FortiIsolator before version 2.4.6 allows a privileged attacker with super-admin profile and CLI access to execute unauthorized code via specifically crafted HTTP requests.
Weakness: CWE-78
Affected products
| Vendor | Product | Category | Matched by |
|---|---|---|---|
| Fortinet | FortiIsolator | SASE / SSE / Secure Web | cna-assigner |
Vendor-reported affected versions (1)
- Fortinet · FortiIsolator
Vendor remediation
Please upgrade to FortiIsolator version 2.4.7 or above