PT-2025-10769 · Fortinet · Fortianalyzer+1
Published
2025-03-11
·
Updated
2025-03-12
·
CVE-2024-32123
CVSS v2.0
6.8
Medium
| Vector | AV:L/AC:L/Au:S/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions:
Fortinet FortiManager, FortiAnalyzer versions 7.4.0 through 7.4.2
Fortinet FortiManager, FortiAnalyzer versions 7.2.0 through 7.2.5
Fortinet FortiManager, FortiAnalyzer versions 7.0.0 through 7.0.12
Fortinet FortiManager, FortiAnalyzer versions 6.4.0 through 6.4.14
Fortinet FortiManager, FortiAnalyzer versions 6.2.0 through 6.2.12
Fortinet FortiManager, FortiAnalyzer versions 6.0.0 through 6.0.12
Fortinet FortiManager, FortiAnalyzer versions 5.6.0 through 5.6.11
Fortinet FortiManager, FortiAnalyzer versions 5.4.0 through 5.4.7
Fortinet FortiManager, FortiAnalyzer versions 5.2.0 through 5.2.10
Fortinet FortiManager, FortiAnalyzer versions 5.0.0 through 5.0.12
Fortinet FortiManager, FortiAnalyzer versions 4.3.4 through 4.3.8
Description:
The issue is related to multiple improper neutralization of special elements used in an os command, also known as 'os command injection', in Fortinet FortiManager and FortiAnalyzer. This allows an attacker to execute unauthorized code or commands via crafted CLI requests.
Recommendations:
For versions 7.4.0 through 7.4.2, update to a version outside of this range to mitigate the risk.
For versions 7.2.0 through 7.2.5, update to a version outside of this range to mitigate the risk.
For versions 7.0.0 through 7.0.12, update to a version outside of this range to mitigate the risk.
For versions 6.4.0 through 6.4.14, update to a version outside of this range to mitigate the risk.
For versions 6.2.0 through 6.2.12, update to a version outside of this range to mitigate the risk.
For versions 6.0.0 through 6.0.12, update to a version outside of this range to mitigate the risk.
For versions 5.6.0 through 5.6.11, update to a version outside of this range to mitigate the risk.
For versions 5.4.0 through 5.4.7, update to a version outside of this range to mitigate the risk.
For versions 5.2.0 through 5.2.10, update to a version outside of this range to mitigate the risk.
For versions 5.0.0 through 5.0.12, update to a version outside of this range to mitigate the risk.
For versions 4.3.4 through 4.3.8, update to a version outside of this range to mitigate the risk.
As a temporary workaround, consider restricting access to the CLI to minimize the risk of exploitation.
Fix
OS Command Injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Fortianalyzer
Fortimanager