CVE-2025-53680

Summary

An improper neutralization of special elements used in an OS command ("OS Command Injection") vulnerability [CWE-78] vulnerability in Fortinet FortiAP 7.6.0 through 7.6.2, FortiAP 7.4.0 through 7.4.5, FortiAP 7.2 all versions, FortiAP 7.0 all versions, FortiAP 6.4 all versions, FortiAP-U 7.0.0 through 7.0.5, FortiAP-U 6.2 all versions, FortiAP-W2 7.4.0 through 7.4.4, FortiAP-W2 7.2 all versions, FortiAP-W2 7.0 all versions allows an authenticated privileged attacker to execute unauthorized code or commands via crafted CLI requests.

Affected Software

VendorProductVersion RangeStatus
FortinetFortiAP7.6.0 <= 7.6.2affected
FortinetFortiAP7.4.0 <= 7.4.5affected
FortinetFortiAP7.2.0 <= 7.2.6affected
FortinetFortiAP7.0.0 <= 7.0.7affected
FortinetFortiAP6.4.3 <= 6.4.9affected
FortinetFortiAP-W27.4.0 <= 7.4.4affected
FortinetFortiAP-W27.2.0 <= 7.2.5affected
FortinetFortiAP-W27.0.0 <= 7.0.8affected
FortinetFortiAP-U7.0.0 <= 7.0.5affected
FortinetFortiAP-U6.2.0 <= 6.2.6affected

Weaknesses

  • CWE-78: Execute unauthorized code or commands

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: total

References