An improper neutralization of special elements used in an OS Command ("OS Command Injection") vulnerability [CWE-78] in Fortinet FortiADC version 7.2.0 and before 7.1.1 allows a remote and authenticated attacker with low privilege to execute unauthorized code via specifically crafted HTTP parameters.
CVSS
No CVSS.
References
| Link | Resource |
|---|---|
| https://fortiguard.fortinet.com/psirt/FG-IR-25-501 | Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
15 Aug 2025, 12:26
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://fortiguard.fortinet.com/psirt/FG-IR-25-501 - Vendor Advisory | |
| CPE | cpe:2.3:a:fortinet:fortiadc:7.2.0:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiadc:*:*:*:*:*:*:*:* |
|
| First Time |
Fortinet fortiadc
Fortinet |
12 Aug 2025, 19:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-08-12 19:15
Updated : 2025-08-15 12:26
NVD link : CVE-2025-49813
Mitre link : CVE-2025-49813
JSON object : View
Products Affected
fortinet
- fortiadc
CWE
CWE-78
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')