CVE-2025-49813
An improper neutralization of special elements used in an OS Command ("OS Command Injection") vulnerability [CWE-78] in Fortinet FortiADC version 7.2.0 and before 7.1.1 allows a remote and authenticat
Severity
Medium 6.6
CVSS 3.1
Exploited
Not listed
EPSS
0.011
62.3th percentile
Discovered by
Not disclosed
Published
Aug 12, 2025
Assigned by fortinet
Description
An improper neutralization of special elements used in an OS Command ("OS Command Injection") vulnerability [CWE-78] in Fortinet FortiADC version 7.2.0 and before 7.1.1 allows a remote and authenticated attacker with low privilege to execute unauthorized code via specifically crafted HTTP parameters.
Weakness: CWE-78
Affected products
| Vendor | Product | Category | Matched by |
|---|---|---|---|
| Fortinet | FortiADC | Web & Application Security | cna-assigner |
Vendor-reported affected versions (1)
- Fortinet · FortiADC
Vendor remediation
Please upgrade to FortiADC version 7.2.1 or above Please upgrade to FortiADC version 7.1.2 or above