Command injection in web interface


An improper neutralization of special elements used in an OS Command vulnerability [CWE-78] in FortiADC may allow an authenticated attacker with access to the web GUI to execute unauthorized code or commands via specifically crafted HTTP requests.

Affected Products

FortiADC version 7.0.0 through 7.0.1
FortiADC version 6.2.0 through 6.2.3
FortiADC version 5.4.0 through 5.4.5
FortiADC all versions 6.1
FortiADC all versions 6.0


Please upgrade to FortiADC 7.0.2 or above
Please upgrade to FortiADC 6.2.4 or above
Please upgrade to upcoming FortiADC 5.4.6 or above


Internally discovered and reported by Gwendal Guégniaud of Fortinet Product Security Team.