CVE-2022-27486: OS Command Injection
First published: Tue Aug 13 2024(Updated: )
A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiDDoS version 5.5.0 through 5.5.1, 5.4.2 through 5.4.0, 5.3.0 through 5.3.1, 5.2.0, 5.1.0, 5.0.0, 4.7.0, 4.6.0 and 4.5.0 and FortiDDoS-F version 6.3.0 through 6.3.1, 6.2.0 through 6.2.2, 6.1.0 through 6.1.4 allows an authenticated attacker to execute shell code as `root` via `execute` CLI commands.
Credit: psirt@fortinet.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Fortinet FortiDDoS-F | >=4.5.0<5.6.2 | |
| Fortinet FortiDDoS-F | =5.7.0 | |
| Fortinet FortiDDoS-F | ||
| Fortinet FortiDDoS-F | >=6.1.0<6.4.2 | |
| Fortinet FortiDDoS-F | =6.5.0 |
Remedy
Please upgrade to FortiDDoS version 5.7.1 or above Please upgrade to FortiDDoS version 5.6.2 or above Please upgrade to FortiDDoS version 5.5.2 or above Please upgrade to FortiDDoS version 5.4.3 or above Please upgrade to FortiDDoS-F version 6.5.1 or above Please upgrade to FortiDDoS-F version 6.4.2 or above
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2022-27486?
CVE-2022-27486 has been rated as a high severity vulnerability due to its potential for remote code execution via OS command injection.
How do I fix CVE-2022-27486?
To fix CVE-2022-27486, update FortiDDoS or FortiDDoS-F to the latest version that is not affected by this vulnerability.
What versions are affected by CVE-2022-27486?
CVE-2022-27486 affects Fortinet FortiDDoS versions from 4.5.0 up to 5.6.2 and FortiDDoS-F versions from 6.1.0 up to 6.4.2.
What is the attack vector for CVE-2022-27486?
The attack vector for CVE-2022-27486 is remote, allowing attackers to execute arbitrary commands on the affected system.
Are there any known exploits for CVE-2022-27486?
As of now, there are no publicly known exploits for CVE-2022-27486, but the nature of the vulnerability suggests potential for exploitation.
- agent/remedy
- agent/references
- agent/weakness
- agent/type
- agent/description
- agent/first-publish-date
- agent/author
- agent/event
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/last-modified-date
- agent/softwarecombine
- agent/source
- agent/tags
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/fortinet
- canonical/fortinet fortiddos-f
- version/fortinet fortiddos-f/4.5.0
- version/fortinet fortiddos-f/5.7.0
- version/fortinet fortiddos-f/6.1.0
- version/fortinet fortiddos-f/6.5.0