CVE-2024-54025
An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability [CWE-78] in Fortinet FortiIsolator CLI before version 2.4.6 allows a privileged attacker to
Severity
Medium 6.5
CVSS 3.1
Exploited
Not listed
EPSS
0.004
38.1th percentile
Discovered by
Vendor
Vendor advisory field
Published
Apr 8, 2025
Assigned by fortinet
Description
An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability [CWE-78] in Fortinet FortiIsolator CLI before version 2.4.6 allows a privileged attacker to execute unauthorized code or commands via crafted CLI requests.
Weakness: CWE-78
Affected products
| Vendor | Product | Category | Matched by |
|---|---|---|---|
| Fortinet | FortiIsolator | SASE / SSE / Secure Web | cna-assigner |
Vendor-reported products (1)
- Fortinet · FortiIsolator
Credit
Internally discovered and reported by Adham El karn of Fortinet Product Security team.
Vendor remediation
Please upgrade to FortiIsolator version 2.4.7 or above