PT-2025-6263 · Fortinet · Fortiweb

Published 2025-02-11 · Updated 2025-02-24 · CVE-2024-50569

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: FortiWeb versions 7.0.0 through 7.6.0

Description: The issue exists due to the improper neutralization of special elements used in an os command, which can be exploited by an attacker to execute unauthorized code or commands via crafted input. This can allow a remote attacker to execute arbitrary commands or code by sending specially crafted requests.

Recommendations: For FortiWeb versions 7.0.0 through 7.6.0, consider disabling the vulnerable os command injection functionality until a patch is available. Restrict access to the system to minimize the risk of exploitation. Avoid using specially crafted input that could trigger the os command injection vulnerability. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

BDU:2025-01603

CVE-2024-50569

ZDI-25-095

Affected Products

Fortiweb

References · 8

• https://bdu.fstec.ru/vul/2025-01603 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-25-095 · Security Note
• https://fortiguard.fortinet.com/psirt/FG-IR-24-438 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-50569 · Security Note
• https://osv.dev/vulnerability/CVE-2024-50569 · Vendor Advisory
• https://vuldb.com/de/?id.295279 · Note
• https://twitter.com/CVEnew/status/1889355112859983941 · Twitter Post
• https://t.me/cvedetector/17724 · Telegram Post