CVE-2022-27482: OS Command Injection
First published: Thu Feb 16 2023(Updated: )
A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiADC version 7.0.0 through 7.0.1, 6.2.0 through 6.2.2, 6.1.0 through 6.1.6, 6.0.x, 5.x.x allows attacker to execute arbitrary shell code as `root` via CLI commands.
Credit: psirt@fortinet.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Fortinet FortiADC | >=5.0.0<=5.0.4 | |
| Fortinet FortiADC | >=5.1.0<=5.1.7 | |
| Fortinet FortiADC | >=5.2.0<=5.2.8 | |
| Fortinet FortiADC | >=5.3.0<=5.3.7 | |
| Fortinet FortiADC | >=5.4.0<=5.4.5 | |
| Fortinet FortiADC | >=6.0.0<=6.0.4 | |
| Fortinet FortiADC | >=6.1.0<=6.1.6 | |
| Fortinet FortiADC | >=6.2.0<6.2.4 | |
| Fortinet FortiADC | =7.0.0 | |
| Fortinet FortiADC | =7.0.1 |
Remedy
Please upgrade to FortiADC version 7.0.2 or above, Please upgrade to FortiADC version 6.2.4 or above.
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2022-27482?
CVE-2022-27482 is a vulnerability in Fortinet FortiADC that allows an attacker to execute arbitrary shell code as root via CLI commands.
Which versions of Fortinet FortiADC are affected?
Fortinet FortiADC versions 7.0.0 through 7.0.1, 6.2.0 through 6.2.2, 6.1.0 through 6.1.6, 6.0.x, 5.x.x are affected.
What is the severity of CVE-2022-27482?
The severity of CVE-2022-27482 is high with a CVSS score of 7.8.
How can an attacker exploit CVE-2022-27482?
An attacker can exploit CVE-2022-27482 by exploiting a command injection vulnerability in Fortinet FortiADC to execute arbitrary shell code as root via CLI commands.
Is there a fix for CVE-2022-27482?
Yes, it is recommended to update to a patched version of Fortinet FortiADC to mitigate CVE-2022-27482.
- collector/nvd-index
- agent/type
- agent/weakness
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/remedy
- agent/last-modified-date
- agent/severity
- agent/references
- agent/author
- agent/first-publish-date
- agent/tags
- agent/description
- agent/event
- vendor/fortinet
- canonical/fortinet fortiadc
- version/fortinet fortiadc/5.0.0
- version/fortinet fortiadc/5.0.4
- version/fortinet fortiadc/5.1.0
- version/fortinet fortiadc/5.1.7
- version/fortinet fortiadc/5.2.0
- version/fortinet fortiadc/5.2.8
- version/fortinet fortiadc/5.3.0
- version/fortinet fortiadc/5.3.7
- version/fortinet fortiadc/5.4.0
- version/fortinet fortiadc/5.4.5
- version/fortinet fortiadc/6.0.0
- version/fortinet fortiadc/6.0.4
- version/fortinet fortiadc/6.1.0
- version/fortinet fortiadc/6.1.6
- version/fortinet fortiadc/6.2.0
- version/fortinet fortiadc/7.0.0
- version/fortinet fortiadc/7.0.1