CVE-2023-36634: Arbitrary file listing and deletion through the CLI
An incomplete filtering of one or more instances of special elements vulnerability [CWE-792] in the command line interpreter of FortiAP-U 7.0.0, 6.2.0 through 6.2.5, 6.0 all versions, 5.4 all versions may allow an authenticated attacker to list and delete arbitrary files and directory via specially crafted command arguments.
Other sources
An incomplete filtering of one or more instances of special elements vulnerability [CWE-792] in the command line interpreter of FortiAP-U may allow an authenticated attacker to list and delete arbitrary files and directory via specially crafted command arguments.
— FortiGuard
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the vulnerability ID for this vulnerability?
The vulnerability ID for this vulnerability is CVE-2023-36634.
What is the severity level of CVE-2023-36634?
The severity level of CVE-2023-36634 is high.
What is the affected software for CVE-2023-36634?
The affected software for CVE-2023-36634 is FortiAP-U versions 7.0.0, 6.2.0 through 6.2.5, 6.0 all versions, and 5.4 all versions.
How can an attacker exploit CVE-2023-36634?
An authenticated attacker can exploit CVE-2023-36634 to list and delete arbitrary files and directories via specially crafted commands in the command line interpreter of FortiAP-U.
Is there a fix available for CVE-2023-36634?
Yes, Fortinet has released a fix for CVE-2023-36634. Please refer to the FortiGuard advisory for more information: https://fortiguard.com/psirt/FG-IR-23-123