Description
An improper neutralization of special elements used in an OS Command ("OS Command Injection") vulnerability [CWE-78] in Fortinet FortiADC version 7.2.0 and before 7.1.1 allows a remote and authenticated attacker with low privilege to execute unauthorized code via specifically crafted HTTP parameters.
Published: 2025-08-12
Score: 6.6 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

Vendor Solution

Please upgrade to FortiADC version 7.2.1 or above Please upgrade to FortiADC version 7.1.2 or above

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
EUVD EUVD EUVD-2025-24460 An improper neutralization of special elements used in an OS Command ("OS Command Injection") vulnerability [CWE-78] in Fortinet FortiADC version 7.2.0 and before 7.1.1 allows a remote and authenticated attacker with low privilege to execute unauthorized code via specifically crafted HTTP parameters.
History

Fri, 15 Aug 2025 12:30:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:a:fortinet:fortiadc:*:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiadc:7.2.0:*:*:*:*:*:*:*

Tue, 12 Aug 2025 21:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 12 Aug 2025 19:15:00 +0000

Type Values Removed Values Added
Description An improper neutralization of special elements used in an OS Command ("OS Command Injection") vulnerability [CWE-78] in Fortinet FortiADC version 7.2.0 and before 7.1.1 allows a remote and authenticated attacker with low privilege to execute unauthorized code via specifically crafted HTTP parameters.
First Time appeared Fortinet
Fortinet fortiadc
Weaknesses CWE-78
CPEs cpe:2.3:h:fortinet:fortiadc:6.2.0:*:*:*:*:*:*:*
cpe:2.3:h:fortinet:fortiadc:6.2.1:*:*:*:*:*:*:*
cpe:2.3:h:fortinet:fortiadc:6.2.2:*:*:*:*:*:*:*
cpe:2.3:h:fortinet:fortiadc:6.2.3:*:*:*:*:*:*:*
cpe:2.3:h:fortinet:fortiadc:6.2.4:*:*:*:*:*:*:*
cpe:2.3:h:fortinet:fortiadc:6.2.5:*:*:*:*:*:*:*
cpe:2.3:h:fortinet:fortiadc:6.2.6:*:*:*:*:*:*:*
cpe:2.3:h:fortinet:fortiadc:7.1.0:*:*:*:*:*:*:*
cpe:2.3:h:fortinet:fortiadc:7.1.1:*:*:*:*:*:*:*
cpe:2.3:h:fortinet:fortiadc:7.2.0:*:*:*:*:*:*:*
Vendors & Products Fortinet
Fortinet fortiadc
References
Metrics cvssV3_1

{'score': 6.6, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:U/RL:U/RC:C'}

Subscriptions

Fortinet Fortiadc
cve-icon MITRE

Status: PUBLISHED

Assigner: fortinet

Published:

Updated: 2026-02-26T17:48:59.044Z

Reserved: 2025-06-11T13:46:02.438Z

Link: CVE-2025-49813

cve-icon Vulnrichment

Updated: 2025-08-12T20:15:36.980Z

cve-icon NVD

Status : Analyzed

Published: 2025-08-12T19:15:30.853

Modified: 2025-08-15T12:26:02.137

Link: CVE-2025-49813

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses