CyberCVE

CVE-2025-31104

A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiADC 7.6.0 through 7.6.1, FortiADC 7.4.0 through 7.4.6, FortiADC 7.2.0 throug

Severity
High 7
CVSS 3.1
Exploited
Not listed
EPSS
0.011
63.5th percentile
Discovered by
Third party
Vendor advisory field
Published
Jun 10, 2025
Assigned by fortinet

Description

A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiADC 7.6.0 through 7.6.1, FortiADC 7.4.0 through 7.4.6, FortiADC 7.2.0 through 7.2.7, FortiADC 7.1.0 through 7.1.4, FortiADC 7.0 all versions, FortiADC 6.2 all versions, FortiADC 6.1 all versions, FortiADC 6.0 all versions, FortiADC 5.4 all versions, FortiADC 5.3 all versions, FortiADC 5.2 all versions, FortiADC 5.1 all versions, FortiADC 5.0 all versions, FortiADC 4.8 all versions, FortiADC 4.7 all versions, FortiADC 4.6 all versions, FortiADC 4.5 all versions, FortiADC 4.4 all versions, FortiADC 4.3 all versions, FortiADC 4.2 all versions, FortiADC 4.1 all versions, FortiADC 4.0 all versions, FortiADC 3.2 all versions, FortiADC 3.1 all versions, FortiADC 3.0 all versions may allow attacker to execute unauthorized code or commands via <insert attack vector here>

Weakness: CWE-78

Affected products

Vendor Product Category Matched by
Fortinet FortiADC Web & Application Security cna-assigner
Vendor-reported products (1)
  • Fortinet · FortiADC

Credit

Fortinet is pleased to thank Kentaro Kawane from GMO Cybersecurity by Ierae for reporting this vulnerability under responsible disclosure.

Vendor remediation

Upgrade to FortiADC version 8.0.0 or above Upgrade to FortiADC version 7.6.2 or above Upgrade to FortiADC version 7.4.7 or above Upgrade to FortiADC version 7.2.8 or above Upgrade to FortiADC version 7.1.5 or above

References

Something wrong here?