PT-2025-6262 · Fortinet · Fortiweb

Published 2025-02-11 · Updated 2025-02-24 · CVE-2024-50567

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: Fortinet FortiWeb versions 7.4.0 through 7.6.0

Description: The issue is related to an improper neutralization of special elements used in an os command, also known as 'os command injection'. This allows an attacker to execute unauthorized code or commands via crafted input. The vulnerability can be exploited by a remote attacker by sending specially crafted requests, potentially allowing them to execute arbitrary commands or code.

Recommendations: For Fortinet FortiWeb versions 7.4.0 through 7.6.0, update to a version that includes a fix for this issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

BDU:2025-01604

CVE-2024-50567

ZDI-25-094

Affected Products

Fortiweb

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2024-50567 · Security Note
• https://fortiguard.fortinet.com/psirt/FG-IR-24-438 · Vendor Advisory
• https://zerodayinitiative.com/advisories/ZDI-25-094 · Security Note
• https://bdu.fstec.ru/vul/2025-01604 · Security Note
• https://osv.dev/vulnerability/CVE-2024-50567 · Vendor Advisory
• https://twitter.com/CVEnew/status/1889355107461988357 · Twitter Post
• https://vuldb.com/de/?id.295278 · Note