PT-2025-10782 · Fortinet · Fortiisolator

Published 2025-03-11 · Updated 2025-07-23 · CVE-2024-55590

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: Fortinet FortiIsolator versions 2.4.0 through 2.4.5

Description: The issue is related to multiple improper neutralization of special elements used in an OS command, also known as 'OS Command Injection'. This allows an authenticated attacker with at least read-only admin permission and CLI access to execute unauthorized code via specifically crafted CLI commands.

Recommendations: For Fortinet FortiIsolator versions 2.4.0 through 2.4.5, consider disabling CLI access for users with read-only admin permission until a patch is available. Restrict access to specifically crafted CLI commands to minimize the risk of exploitation. As a temporary workaround, limit the use of CLI commands that may be used to execute unauthorized code. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

BDU:2025-03635

CVE-2024-55590

Affected Products

Fortiisolator

References · 11

• https://nvd.nist.gov/vuln/detail/CVE-2024-55590 · Security Note
• https://fortiguard.fortinet.com/psirt/FG-IR-24-178 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-55590 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-03635 · Security Note
• https://twitter.com/CVEnew/status/1899479455032111491 · Twitter Post
• https://t.me/cvedetector/20091 · Telegram Post
• https://twitter.com/CveFindCom/status/1899475630787338610 · Twitter Post
• https://t.me/cvetracker/18952 · Telegram Post
• https://reddit.com/r/k12cybersecurity/comments/1j9jupx/msisac_cybersecurity_advisory_multiple · Reddit Post
• https://t.me/cveNotify/130006 · Telegram Post
• https://t.me/true_secator/6837 · Telegram Post