CVE-2024-54024: OS command injection on diagnose feature (GUI)
An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability [CWE-78] in FortiIsolator may allow a privileged attacker with super-admin profile and CLI access to execute unauthorized code via specifically crafted HTTP requests.
Other sources
An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability [CWE-78] in Fortinet FortiIsolator before version 2.4.6 allows a privileged attacker with super-admin profile and CLI access to execute unauthorized code via specifically crafted HTTP requests.
— MITRE
Affected Software
Remediation
Information
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the severity of CVE-2024-54024?
CVE-2024-54024 has been classified with a high severity rating due to the potential for OS command injection conducted by privileged attackers.
How do I fix CVE-2024-54024?
To mitigate CVE-2024-54024, upgrade Fortinet FortiIsolator to version 2.4.6 or later.
Who is affected by CVE-2024-54024?
CVE-2024-54024 specifically affects Fortinet FortiIsolator versions prior to 2.4.6.
What types of access are required to exploit CVE-2024-54024?
Exploitation of CVE-2024-54024 requires a privileged attacker with super-admin profile and CLI access.
What can an attacker achieve by exploiting CVE-2024-54024?
Exploiting CVE-2024-54024 allows an attacker to execute unauthorized code on the affected system.