PT-2022-1807 · Fortinet · Fortiap-C

Published 2022-03-01 · Updated 2022-03-10 · CVE-2022-22301

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions FortiAP-C console versions 5.2.0 through 5.2.1 FortiAP-C console versions 5.4.0 through 5.4.3

Description The issue is related to an improper neutralization of special elements used in an OS Command, which may allow an authenticated attacker to execute unauthorized commands by running CLI commands with specifically crafted arguments.

Recommendations For FortiAP-C console versions 5.2.0 through 5.2.1, update to a version outside of this range to mitigate the risk. For FortiAP-C console versions 5.4.0 through 5.4.3, update to a version outside of this range to mitigate the risk. As a temporary workaround, consider restricting the use of CLI commands with crafted arguments until a patch is available.

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

BDU:2022-01226

CVE-2022-22301

Affected Products

Fortiap-C

References · 7

• https://bdu.fstec.ru/vul/2022-01226 · Security Note
• https://fortiguard.com/psirt/FG-IR-21-227 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-22301 · Security Note
• https://osv.dev/vulnerability/CVE-2022-22301 · Vendor Advisory
• https://vuldb.com/ru/?id.194056 · Note
• https://t.me/cibsecurity/38288 · Telegram Post
• https://t.me/cvenotify/27595 · Telegram Post