FortiAP - Restricted Shell Escape via CLI Command Injection Fortinet PSIRT Advisories Fortinet PSIRT Contact: Website: https://fortiguard.fortinet.com/faq/psirt-contact FG-IR-23-405 Final 1 1 2025-01-14T00:00:00 Current version 2025-01-14T00:00:00 2025-01-14T00:00:00 An improper neutralization of special elements used in an OS command [CWE-78] in FortiAP may allow a local authenticated attacker to execute unauthorized code via the FortiAP CLI. None Execute unauthorized code or commands None Fortinet is pleased to thank Christian Hilgers from indevis for reporting this vulnerability under responsible disclosure FortiAP 7.4.2 FortiAP 7.4.1 FortiAP 7.4.0 FortiAP 7.2.3 FortiAP 7.2.2 FortiAP 7.2.1 FortiAP 7.2.0 FortiAP 7.0.7 FortiAP 7.0.6 FortiAP 7.0.5 FortiAP 7.0.4 FortiAP 7.0.3 FortiAP 7.0.2 FortiAP 7.0.1 FortiAP 7.0.0 FortiAP 6.4.9 FortiAP 6.4.8 FortiAP 6.4.7 FortiAP 6.4.6 FortiAP 6.4.5 FortiAP 6.4.4 FortiAP 6.4.3 FortiAP-S 6.4.9 FortiAP-S 6.4.8 FortiAP-S 6.4.7 FortiAP-S 6.4.6 FortiAP-S 6.4.5 FortiAP-S 6.4.4 FortiAP-S 6.4.3 FortiAP-S 6.4.2 FortiAP-S 6.4.1 FortiAP-S 6.4.0 FortiAP-S 6.2.6 FortiAP-S 6.2.5 FortiAP-S 6.2.4 FortiAP-S 6.2.3 FortiAP-S 6.2.2 FortiAP-S 6.2.1 FortiAP-S 6.2.0 FortiAP-W2 7.4.2 FortiAP-W2 7.4.1 FortiAP-W2 7.4.0 FortiAP-W2 7.2.3 FortiAP-W2 7.2.2 FortiAP-W2 7.2.1 FortiAP-W2 7.2.0 FortiAP-W2 7.0.8 FortiAP-W2 7.0.7 FortiAP-W2 7.0.6 FortiAP-W2 7.0.5 FortiAP-W2 7.0.4 FortiAP-W2 7.0.3 FortiAP-W2 7.0.2 FortiAP-W2 7.0.1 FortiAP-W2 7.0.0 FortiAP-W2 6.4.10 FortiAP-W2 6.4.9 FortiAP-W2 6.4.8 FortiAP-W2 6.4.7 FortiAP-W2 6.4.6 FortiAP-W2 6.4.5 FortiAP-W2 6.4.4 FortiAP-W2 6.4.3 FortiAP-W2 6.4.2 FortiAP-W2 6.4.1 FortiAP-W2 6.4.0 CVE-2024-26012 FortiAP-7.4.2 FortiAP-7.4.1 FortiAP-7.4.0 FortiAP-7.2.3 FortiAP-7.2.2 FortiAP-7.2.1 FortiAP-7.2.0 FortiAP-7.0.7 FortiAP-7.0.6 FortiAP-7.0.5 FortiAP-7.0.4 FortiAP-7.0.3 FortiAP-7.0.2 FortiAP-7.0.1 FortiAP-7.0.0 FortiAP-6.4.9 FortiAP-6.4.8 FortiAP-6.4.7 FortiAP-6.4.6 FortiAP-6.4.5 FortiAP-6.4.4 FortiAP-6.4.3 FortiAP-S-6.4.9 FortiAP-S-6.4.8 FortiAP-S-6.4.7 FortiAP-S-6.4.6 FortiAP-S-6.4.5 FortiAP-S-6.4.4 FortiAP-S-6.4.3 FortiAP-S-6.4.2 FortiAP-S-6.4.1 FortiAP-S-6.4.0 FortiAP-S-6.2.6 FortiAP-S-6.2.5 FortiAP-S-6.2.4 FortiAP-S-6.2.3 FortiAP-S-6.2.2 FortiAP-S-6.2.1 FortiAP-S-6.2.0 FortiAP-W2-7.4.2 FortiAP-W2-7.4.1 FortiAP-W2-7.4.0 FortiAP-W2-7.2.3 FortiAP-W2-7.2.2 FortiAP-W2-7.2.1 FortiAP-W2-7.2.0 FortiAP-W2-7.0.8 FortiAP-W2-7.0.7 FortiAP-W2-7.0.6 FortiAP-W2-7.0.5 FortiAP-W2-7.0.4 FortiAP-W2-7.0.3 FortiAP-W2-7.0.2 FortiAP-W2-7.0.1 FortiAP-W2-7.0.0 FortiAP-W2-6.4.10 FortiAP-W2-6.4.9 FortiAP-W2-6.4.8 FortiAP-W2-6.4.7 FortiAP-W2-6.4.6 FortiAP-W2-6.4.5 FortiAP-W2-6.4.4 FortiAP-W2-6.4.3 FortiAP-W2-6.4.2 FortiAP-W2-6.4.1 FortiAP-W2-6.4.0 6.3 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:U/RC:C https://fortiguard.fortinet.com/psirt/FG-IR-23-405 FortiAP - Restricted Shell Escape via CLI Command Injection Reference>