PT-2025-50114 · Fortinet · Fortisandbox

Published 2025-12-09 · Updated 2025-12-16 · CVE-2025-53949

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Fortinet FortiSandbox versions 4.0 all versions Fortinet FortiSandbox versions 4.2 all versions Fortinet FortiSandbox versions 4.4.0 through 4.4.7 Fortinet FortiSandbox versions 5.0.0 through 5.0.2

Description The Fortinet FortiSandbox software contains an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') issue. This allows an authenticated attacker to execute unauthorized code on the underlying system via crafted HTTP requests. The issue affects multiple areas, including the upload vdi file functionality, the name parameter, and the admindel confirm parameter. The vulnerability is triggered by crafted HTTP requests. The name parameter and upload vdi file are specifically identified as points of exploitation.

Recommendations Fortinet FortiSandbox version 4.0 all versions: At the moment, there is no information about a newer version that contains a fix for this vulnerability. Fortinet FortiSandbox version 4.2 all versions: At the moment, there is no information about a newer version that contains a fix for this vulnerability. Fortinet FortiSandbox versions 4.4.0 through 4.4.7: At the moment, there is no information about a newer version that contains a fix for this vulnerability. Fortinet FortiSandbox versions 5.0.0 through 5.0.2: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

BDU:2026-04851

CVE-2025-53949

ZDI-25-1095

ZDI-25-1096

ZDI-25-1097

Affected Products

Fortisandbox

References · 12

• https://fortiguard.fortinet.com/psirt/FG-IR-25-479 · Vendor Advisory
• https://zerodayinitiative.com/advisories/ZDI-25-1097 · Security Note
• https://osv.dev/vulnerability/CVE-2025-53949 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-53949 · Security Note
• https://bdu.fstec.ru/vul/2026-04851 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-25-1095 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-25-1096 · Security Note
• https://twitter.com/CVEnew/status/1998781396542738545 · Twitter Post
• https://twitter.com/TheZDIBugs/status/2001079043186180122 · Twitter Post
• https://twitter.com/threatcluster/status/1998759833105809441 · Twitter Post
• https://twitter.com/TheZDIBugs/status/2001079045576950246 · Twitter Post
• https://twitter.com/TheZDIBugs/status/2001079044419334219 · Twitter Post