PT-2022-5803 · Fortinet · Fortiwan

Published 2022-04-05 · Updated 2022-04-13 · CVE-2021-24009

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions FortiWAN versions prior to 4.5.9

Description The issue is related to the improper neutralization of special elements used in an OS command in the FortiWAN web interface. This could allow a remote attacker to execute arbitrary commands on the underlying system's shell by sending specially crafted HTTP requests. The attacker must be authenticated to exploit this issue.

Recommendations For versions prior to 4.5.9, update to version 4.5.9 or later to resolve the issue. As a temporary workaround, consider restricting access to the web interface to minimize the risk of exploitation.

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

BDU:2022-07206

CVE-2021-24009

Affected Products

Fortiwan

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2021-24009 · Security Note
• https://fortiguard.com/psirt/FG-IR-21-060 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-24009 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-07206 · Security Note
• https://vuldb.com/?id.196590 · Note
• https://t.me/cvenotify/28526 · Telegram Post
• https://t.me/cvenotify/28516 · Telegram Post