PSIRT Advisories

FortiAP & FortiAP-S & FortiAP-W2 & FortiAP-U - Command injection in CLI

Summary

An improper neutralization of special elements [CWE-89] used in an OS command vulnerability [CWE-78] in the command line interpreter of FortiAP, FortiAP-S, FortiAP-W2 and FortiAP-U may allow an authenticated attacker to execute unauthorized commands via specifically crafted arguments to existing commands.

Affected Products

FortiAP-U version 5.4.0 through 5.4.6
FortiAP-U version 6.0.0 through 6.0.4
FortiAP-U version 6.2.0 through 6.2.3
FortiAP-W2 version 6.0.0 through 6.0.6
FortiAP-W2 version 6.2.0 through 6.2.6
FortiAP-W2 version 6.4.0 through 6.4.7
FortiAP-W2 version 7.0.0 through 7.0.3
FortiAP-W2 version 7.2.0
FortiAP-S version 6.0.0 through 6.0.6
FortiAP-S version 6.2.0 through 6.2.6
FortiAP-S version 6.4.0 through 6.4.7
FortiAP version 6.0.0 through 6.0.6
FortiAP version 6.4.3 through 6.4.7
FortiAP version 7.0.0 through 7.0.3
FortiAP version 7.2.0

Solutions

Please upgrade to FortiAP 7.2.1 or above.
Please upgrade to FortiAP 7.0.4 or above.
Please upgrade to FortiAP 6.4.8 or above.

Please upgrade to FortiAP-W2 7.2.1 or above.
Please upgrade to FortiAP-W2 7.0.4 or above.
Please upgrade to FortiAP-W2 6.4.8 or above.

Please upgrade to FortiAP-S 6.4.8 or above.

Please upgrade to FortiAP-U 6.2.4 or above.

 

Acknowledgement

Internally discovered and reported by Wilfried Djettchou of Fortinet Product Security team.