CVE-2023-28000: OS Command Injection

Q: What is the severity of CVE-2023-28000?

The severity of CVE-2023-28000 is high.

Q: Which versions of FortiADC are affected by CVE-2023-28000?

FortiADC versions 6.0.0 through 6.0.4, 6.1.0 through 6.1.6, 6.2.0 through 6.2.4, 7.0.0 through 7.0.3, and 7.1.0 are affected by CVE-2023-28000.

Q: How can an attacker exploit CVE-2023-28000?

A local and authenticated attacker can exploit CVE-2023-28000 by executing unauthorized commands using specially crafted arguments.

Q: Is authentication required to exploit CVE-2023-28000?

Yes, authentication is required to exploit CVE-2023-28000.

Q: Where can I find more information about CVE-2023-28000?

You can find more information about CVE-2023-28000 at the FortiGuard PSIRT website.

Published Jun 13, 2023

Updated

An improper neutralization of special elements used in an OS command vulnerability [CWE-78] in FortiADC CLI 7.1.0, 7.0.0 through 7.0.3, 6.2.0 through 6.2.4, 6.1 all versions, 6.0 all versions may allow a local and authenticated attacker to execute unauthorized commands via specifically crafted arguments in diagnose system df CLI command.

Affected Software

5 affected components

Fortinet FortiADC>=6.0.0<=6.0.4

Fortinet FortiADC>=6.1.0<=6.1.6

Fortinet FortiADC>=6.2.0<=6.2.4

Fortinet FortiADC>=7.0.0<=7.0.3

Fortinet FortiADC=7.1.0

Remediation

Information

Please upgrade to FortiADC version 7.1.1 or above Please upgrade to FortiADC version 7.0.4 or above Please upgrade to FortiADC version 6.2.5 or above

Event History

Jun 13, 2023

CVE Published

via MITRE·08:41 AM

Data Sourced

via MITRE·08:41 AM

RemedyDescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2023-28000?

The severity of CVE-2023-28000 is high.

Which versions of FortiADC are affected by CVE-2023-28000?

FortiADC versions 6.0.0 through 6.0.4, 6.1.0 through 6.1.6, 6.2.0 through 6.2.4, 7.0.0 through 7.0.3, and 7.1.0 are affected by CVE-2023-28000.

How can an attacker exploit CVE-2023-28000?