CVE-2022-27486

A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiDDoS version 5.5.0 through 5.5.1, 5.4.2 through 5.4.0, 5.3.0 through 5.3.1, 5.2.0, 5.1.0, 5.0.0, 4.7.0, 4.6.0 and 4.5.0 and FortiDDoS-F version 6.3.0 through 6.3.1, 6.2.0 through 6.2.2, 6.1.0 through 6.1.4 allows an authenticated attacker to execute shell code as `root` via `execute` CLI commands.

Score

CVSS 3.1 7.8 High

Status

Analyzed - psirt@fortinet.com

Published

2024-08-13

Last modified

2024-08-14

Weaknesses

CWE-78

Affected products

• Fortiddos (Fortinet)
• Fortiddos-f (Fortinet)

References

• https://fortiguard.com/psirt/FG-IR-22-047