CyberCVE

CVE-2025-49813

An improper neutralization of special elements used in an OS Command ("OS Command Injection") vulnerability [CWE-78] in Fortinet FortiADC version 7.2.0 and before 7.1.1 allows a remote and authenticat

Severity
Medium 6.6
CVSS 3.1
Exploited
Not listed
EPSS
0.011
64.1th percentile
Discovered by
Third party
Vendor advisory field
Published
Aug 12, 2025
Assigned by fortinet

Description

An improper neutralization of special elements used in an OS Command ("OS Command Injection") vulnerability [CWE-78] in Fortinet FortiADC version 7.2.0 and before 7.1.1 allows a remote and authenticated attacker with low privilege to execute unauthorized code via specifically crafted HTTP parameters.

Weakness: CWE-78

Affected products

Vendor Product Category Matched by
Fortinet FortiADC Web & Application Security cna-assigner
Vendor-reported products (1)
  • Fortinet · FortiADC

Credit

Fortinet is pleased to thank security researcher CataLpa from Dbappsecurity Co. Ltd for discovering and reporting this vulnerability under responsible disclosure.

Vendor remediation

Please upgrade to FortiADC version 7.2.1 or above Please upgrade to FortiADC version 7.1.2 or above

References

Something wrong here?