PT-2023-20192 · Fortinet · Fortiap-U+3

Published 2023-09-13 · Updated 2023-09-15 · CVE-2023-25608

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions FortiAP-W2 versions 6.0 through 7.2.1 FortiAP-C versions 5.2 through 5.4.4 FortiAP versions 6.0 through 7.2.1 FortiAP-U versions 5.4 through 7.0.0

Description An incomplete filtering of one or more instances of special elements in the command line interpreter may allow an authenticated attacker to read arbitrary files via specially crafted command arguments.

Recommendations For FortiAP-W2 versions 6.0 through 7.2.1, update to a version that includes the fix for this issue. For FortiAP-C versions 5.2 through 5.4.4, update to a version that includes the fix for this issue. For FortiAP versions 6.0 through 7.2.1, update to a version that includes the fix for this issue. For FortiAP-U versions 5.4 through 7.0.0, update to a version that includes the fix for this issue. As a temporary workaround, consider restricting access to the command line interpreter to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-792

Related Identifiers

CVE-2023-25608

Affected Products

Fortiap

Fortiap-C

Fortiap-U

Fortiap-W2

References · 5

• https://fortiguard.com/psirt/FG-IR-22-120 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-25608 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-25608 · Security Note
• https://t.me/cibsecurity/70381 · Telegram Post
• https://twitter.com/CVEnew/status/1701942526687498517 · Twitter Post