OS Command Injection Vulnerability in Fortinet FortiManager and FortiAnalyzer
CVE-2024-32123

6.5MEDIUM

Key Information:

Vendor
Fortinet
Status
Fortimanager
Fortianalyzer
Vendor
CVE Published:
11 March 2025

Summary

A vulnerability in Fortinet's FortiManager and FortiAnalyzer products allows attackers to exploit improper neutralization of special elements in OS commands. This flaw enables unauthorized code execution through specially crafted Command Line Interface (CLI) requests across multiple versions, potentially leading to severe system compromise. Organizations using affected versions are advised to implement necessary patches and security measures to mitigate risks.

Affected Version(s)

FortiAnalyzer 7.4.0 <= 7.4.2

FortiAnalyzer 7.2.0 <= 7.2.5

FortiAnalyzer 7.0.0 <= 7.0.13

References

https://fortiguard.com/psirt/FG-IR-24-124

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.