CVE-2025-53679

Summary

An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability [CWE-78] vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.2, FortiSandbox 4.4.0 through 4.4.7, FortiSandbox 4.2 all versions, FortiSandbox 4.0 all versions, FortiSandbox Cloud 24.1, FortiSandbox Cloud 23 all versions allows a remote privileged attacker to execute unauthorized code or commands via crafted HTTP or HTTPS requests.

Affected Software

VendorProductVersion RangeStatus
FortinetFortiSandbox5.0.0 <= 5.0.2affected
FortinetFortiSandbox4.4.0 <= 4.4.7affected
FortinetFortiSandbox4.2.1 <= 4.2.8affected
FortinetFortiSandbox4.0.0 <= 4.0.6affected
FortinetFortiSandbox Cloud24.1affected
FortinetFortiSandbox Cloud23.4affected

Weaknesses

  • CWE-78: Execute unauthorized code or commands

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: total

References