CVE-2019-15708: OS Command Injection
First published: Sun Mar 15 2020(Updated: )
A system command injection vulnerability in the FortiAP-S/W2 6.2.1, 6.2.0, 6.0.5 and below, FortiAP 6.0.5 and below and FortiAP-U below 6.0.0 under CLI admin console may allow unauthorized administrators to run arbitrary system level commands via specially crafted ifconfig commands.
Credit: psirt@fortinet.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Fortinet Fortiap | <=6.0.5 | |
| Fortinet Fortiap-s | <=6.0.5 | |
| Fortinet Fortiap-s | =6.2.0 | |
| Fortinet Fortiap-s | =6.2.1 | |
| Fortinet Fortiap-u | <=6.0.0 | |
| Fortinet Fortiap-w2 | <=6.0.5 | |
| Fortinet Fortiap-w2 | =6.2.0 | |
| Fortinet Fortiap-w2 | =6.2.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2019-15708?
CVE-2019-15708 is a system command injection vulnerability in the FortiAP-S/W2 6.2.1, 6.2.0, 6.0.5 and below, FortiAP 6.0.5 and below, and FortiAP-U below 6.0.0 that allows unauthorized administrators to run arbitrary system level commands.
How does CVE-2019-15708 affect Fortinet Fortiap products?
CVE-2019-15708 affects Fortinet Fortiap products including FortiAP-S/W2 6.2.1, 6.2.0, 6.0.5 and below, FortiAP 6.0.5 and below, and FortiAP-U below 6.0.0.
What is the severity of CVE-2019-15708?
CVE-2019-15708 has a severity level of 6.7 (high).
How can unauthorized administrators exploit CVE-2019-15708?
Unauthorized administrators can exploit CVE-2019-15708 by using specially crafted ifconfig commands to run arbitrary system level commands.
Is there a fix available for CVE-2019-15708?
Yes, Fortinet has provided a fix for CVE-2019-15708. It is recommended to update to the latest version of the affected Fortiap products.
- collector/nvd-index
- agent/references
- agent/severity
- agent/weakness
- agent/author
- agent/type
- agent/description
- agent/event
- agent/first-publish-date
- agent/softwarecombine
- agent/tags
- agent/last-modified-date
- collector/mitre-cve
- source/MITRE
- vendor/fortinet
- canonical/fortinet fortiap
- version/fortinet fortiap/6.0.5
- canonical/fortinet fortiap-s
- version/fortinet fortiap-s/6.0.5
- version/fortinet fortiap-s/6.2.0
- version/fortinet fortiap-s/6.2.1
- canonical/fortinet fortiap-u
- version/fortinet fortiap-u/6.0.0
- canonical/fortinet fortiap-w2
- version/fortinet fortiap-w2/6.0.5
- version/fortinet fortiap-w2/6.2.0
- version/fortinet fortiap-w2/6.2.1