CVE-2025-53870

Summary

An improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiAP 7.6.0 through 7.6.2, FortiAP 7.4.0 through 7.4.5, FortiAP 7.2 all versions, FortiAP 7.0 all versions, FortiAP 6.4 all versions, FortiAP-W2 7.4.0 through 7.4.4, FortiAP-W2 7.2 all versions, FortiAP-W2 7.0 all versions may allow an authenticated attacker to execute unauthorized code or commands via a specifically crafted cli command.

Affected Software

VendorProductVersion RangeStatus
FortinetFortiAP7.6.0 <= 7.6.2affected
FortinetFortiAP7.4.0 <= 7.4.5affected
FortinetFortiAP7.2.0 <= 7.2.6affected
FortinetFortiAP7.0.0 <= 7.0.7affected
FortinetFortiAP6.4.3 <= 6.4.9affected
FortinetFortiAP-W27.4.0 <= 7.4.4affected
FortinetFortiAP-W27.2.0 <= 7.2.5affected
FortinetFortiAP-W27.0.0 <= 7.0.8affected

Weaknesses

  • CWE-78: Escalation of privilege

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: total

References