CVE-2022-27482: OS Command Injection

Q: What is CVE-2022-27482?

CVE-2022-27482 is a vulnerability in Fortinet FortiADC that allows an attacker to execute arbitrary shell code as root via CLI commands.

Q: Which versions of Fortinet FortiADC are affected?

Fortinet FortiADC versions 7.0.0 through 7.0.1, 6.2.0 through 6.2.2, 6.1.0 through 6.1.6, 6.0.x, 5.x.x are affected.

Q: What is the severity of CVE-2022-27482?

The severity of CVE-2022-27482 is high with a CVSS score of 7.8.

Q: How can an attacker exploit CVE-2022-27482?

An attacker can exploit CVE-2022-27482 by exploiting a command injection vulnerability in Fortinet FortiADC to execute arbitrary shell code as root via CLI commands.

Q: Is there a fix for CVE-2022-27482?

Yes, it is recommended to update to a patched version of Fortinet FortiADC to mitigate CVE-2022-27482.

Published Feb 16, 2023

Updated

A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiADC version 7.0.0 through 7.0.1, 6.2.0 through 6.2.2, 6.1.0 through 6.1.6, 6.0.x, 5.x.x allows attacker to execute arbitrary shell code as root via CLI commands.

Affected Software

10 affected components

Fortinet FortiADC>=5.0.0<=5.0.4

Fortinet FortiADC>=5.1.0<=5.1.7

Fortinet FortiADC>=5.2.0<=5.2.8

Fortinet FortiADC>=5.3.0<=5.3.7

Fortinet FortiADC>=5.4.0<=5.4.5

Fortinet FortiADC>=6.0.0<=6.0.4

Fortinet FortiADC>=6.1.0<=6.1.6

Fortinet FortiADC>=6.2.0<6.2.4

Fortinet FortiADC=7.0.0

Fortinet FortiADC=7.0.1

Remediation

Information

Please upgrade to FortiADC version 7.0.2 or above, Please upgrade to FortiADC version 6.2.4 or above.

Event History

Feb 16, 2023

CVE Published

via MITRE·06:06 PM

Data Sourced

via MITRE·06:06 PM

RemedyDescriptionSeverityWeakness

Frequently Asked Questions

What is CVE-2022-27482?

CVE-2022-27482 is a vulnerability in Fortinet FortiADC that allows an attacker to execute arbitrary shell code as root via CLI commands.

Which versions of Fortinet FortiADC are affected?