OS command injections via GET request parameter

Summary

An improper neutralization of special elements used in an OS Command ('OS Command Injection') vulnerability [CWE-78] in FortiADC may allow a remote and authenticated attacker with low privilege to execute unauthorized code via specifically crafted HTTP parameters.

Affected Products

FortiADC 8.0 all versions are not affected
FortiADC 7.6 all versions are not affected
FortiADC 7.4 all versions are not affected
FortiADC version 7.2.0
FortiADC version 7.1.0 through 7.1.1
FortiADC 7.0 all versions are not affected
FortiADC 6.2 all versions

Solutions

Please upgrade to FortiADC version 7.2.1 or above
Please upgrade to FortiADC version 7.1.2 or above

Acknowledgement

Fortinet is pleased to thank security researcher CataLpa from Dbappsecurity Co. Ltd for discovering and reporting this vulnerability under responsible disclosure.

Timeline

2025-08-12: Initial publication