CyberCVE

CVE-2025-31104

An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability [CWE-78] in FortiADC 7.6.0 through 7.6.1, 7.4.0 through 7.4.6, 7.2.0 through 7.2.7, 7.1.0 th

Severity
High 7
CVSS 3.1
Exploited
Not listed
EPSS
0.012
66.0th percentile
Discovered by
Not disclosed
Published
Jun 10, 2025
Assigned by fortinet

Description

An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability [CWE-78] in FortiADC 7.6.0 through 7.6.1, 7.4.0 through 7.4.6, 7.2.0 through 7.2.7, 7.1.0 through 7.1.4, 7.0 all versions, 6.2 all versions, 6.1 all versions may allow an authenticated attacker to execute unauthorized code via crafted HTTP requests.

Weakness: CWE-78

Affected products

Vendor Product Category Matched by
Fortinet FortiADC Web & Application Security cna-assigner
Vendor-reported affected versions (1)
  • Fortinet · FortiADC

Vendor remediation

Please upgrade to FortiADC version 8.0.0 or above Please upgrade to FortiADC version 7.6.2 or above Please upgrade to FortiADC version 7.4.7 or above Please upgrade to FortiADC version 7.2.8 or above Please upgrade to FortiADC version 7.1.5 or above

References