PT-2023-25646 · Fortinet · Fortiap-U

Published 2023-09-13 · Updated 2026-01-29 · CVE-2023-36634

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions FortiAP-U versions 5.4 through 7.0.0 FortiAP-U versions 6.0 through 6.2.5

Description An incomplete filtering of special elements in the command line interpreter may allow an authenticated attacker to list and delete arbitrary files and directories via specially crafted command arguments.

Recommendations For FortiAP-U versions 5.4 through 7.0.0, update to a version that includes a fix for the incomplete filtering of special elements vulnerability. For FortiAP-U versions 6.0 through 6.2.5, update to a version that includes a fix for the incomplete filtering of special elements vulnerability. As a temporary workaround, consider restricting access to the command line interpreter to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-73

Related Identifiers

CVE-2023-36634

Affected Products

Fortiap-U

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2023-36634 · Security Note
• https://fortiguard.com/psirt/FG-IR-23-123 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-36634 · Vendor Advisory
• https://t.me/cibsecurity/70384 · Telegram Post
• https://twitter.com/grok/status/2016960915258683827 · Twitter Post
• https://twitter.com/CVEnew/status/1701942521071333734 · Twitter Post
• https://twitter.com/cracbot/status/1702200554351693905 · Twitter Post