PT-2025-50113 · Fortinet · Fortisandbox

Published 2025-12-09 · Updated 2026-02-05 · CVE-2025-53679

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Fortinet FortiSandbox versions 5.0.0 through 5.0.2 Fortinet FortiSandbox versions prior to 4.4.7

Description An issue exists in Fortinet FortiSandbox that allows a remote privileged attacker to execute unauthorized code or commands. This is due to an improper neutralization of special elements used in an OS command, specifically an OS Command Injection flaw (CWE-78). The attacker can exploit this by sending specially crafted HTTP or HTTPS requests.

Recommendations Update FortiSandbox to a version after 5.0.2. Update FortiSandbox to version 4.4.7 or later.

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

BDU:2026-00830

CVE-2025-53679

Affected Products

Fortisandbox

References · 6

• https://osv.dev/vulnerability/CVE-2025-53679 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-53679 · Security Note
• https://fortiguard.fortinet.com/psirt/FG-IR-25-454 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-00830 · Security Note
• https://t.me/cveNotify/151009 · Telegram Post
• https://twitter.com/CVEnew/status/1998781394730758562 · Twitter Post