CVE-2023-42788

An improper neutralization of special elements used in an os command ('OS Command Injection') vulnerability [CWE-78] in FortiManager & FortiAnalyzer version 7.4.0, version 7.2.0 through 7.2.3, version 7.0.0 through 7.0.8, version 6.4.0 through 6.4.12 and version 6.2.0 through 6.2.11 may allow a local attacker with low privileges to execute unauthorized code via specifically crafted arguments to a CLI command

CVSS v3.1

6.7 MEDIUMCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

CVSS v3.1

7.8 HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS

1.32% chance of exploitation in the next 30 days, 69th percentile

Published

2023-10-10

Updated

2025-12-16

Proof-of-concept exploits (1)

• orangecertcc/security-research/security/advisories/GHSA-qpv8-g6qv-rf8p

References

• CVE Record
• NVD entry

Related

• CVE-2018-7364
• CVE-2019-17570
• CVE-2020-3264
• CVE-2021-0252
• CVE-2021-0253
• CVE-2021-1382