PT-2025-2388 · Fortinet · Fortiap-S+2

Published 2025-01-14 · Updated 2025-01-31 · CVE-2024-26012

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Fortinet FortiAP-S versions 6.2 through 6.4.9 Fortinet FortiAP-S versions 7.0 through 7.4.2 Fortinet FortiAP-W2 versions 6.4 through 7.4.2 Fortinet FortiAP versions 6.4 through 7.4.2

Description: The issue is related to an improper neutralization of special elements used in an os command, also known as 'os command injection'. This allows a local authenticated attacker to execute unauthorized code via the CLI.

Recommendations: For Fortinet FortiAP-S versions 6.2 through 6.4.9, update to a version that contains a fix for this issue. For Fortinet FortiAP-S versions 7.0 through 7.4.2, update to a version that contains a fix for this issue. For Fortinet FortiAP-W2 versions 6.4 through 7.4.2, update to a version that contains a fix for this issue. For Fortinet FortiAP versions 6.4 through 7.4.2, update to a version that contains a fix for this issue. As a temporary workaround, consider restricting access to the CLI to minimize the risk of exploitation.

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

BDU:2025-02660

CVE-2024-26012

Affected Products

Fortiap

Fortiap-S

Fortiap-W2

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2024-26012 · Security Note
• https://fortiguard.fortinet.com/psirt/FG-IR-23-405 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-02660 · Security Note
• https://osv.dev/vulnerability/CVE-2024-26012 · Vendor Advisory
• https://twitter.com/CVEnew/status/1879174629811691846 · Twitter Post
• https://reddit.com/r/k12cybersecurity/comments/1i1xpbm/msisac_cybersecurity_advisory_multiple · Reddit Post
• https://t.me/cvenotify/109489 · Telegram Post