HIGH🇬🇧 English

CVE-2025-53949

CVSS 7.2v3.1pub. 2025-12-09

An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability [CWE-78] vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.2, FortiSandbox 4.4.0 through 4.4.7, FortiSandbox 4.2 all versions, FortiSandbox 4.0 all versions may allow an authenticated attacker to execute unauthorized code on the underlying system via crafted HTTP requests.

oryginał EN

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Fortinet Fortisandbox
APP
Fortinet
4.0.0 – 4.0.64.2.0 – 4.2.84.4.0 – 4.4.75.0.0 – 5.0.2

🔵

ZWERYFIKUJ U PRODUCENTA

Brak jednoznacznych danych o patchu. Sprawdź referencje od producenta.

Tagi

Command Injection

CWE

Referencje

fortiguard.fortinet.com/psirt/FG-IR-25-479…

Powiązane podatności

CVE-2026-25089CRITICAL9.8PL ✓ten sam produkt

Command injection w Fortinet FortiSandbox — dostęp bez uwierzytelnienia

CVE-2026-26083CRITICAL9.8PL ✓ten sam produkt

Brak autoryzacji w Fortinet FortiSandbox umożliwia zdalne wykonanie kodu

CVE-2026-39813CRITICAL9.8ten sam produkt

A path traversal: '../filedir' vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4.0 ...

CVE-2026-39808CRITICAL9.8PL ✓ten sam produkt

Command Injection w Fortinet FortiSandbox umożliwiający RCE

CVE-2025-52436HIGH8.8ten sam produkt

An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability [CWE-79]...