FG-IR-23-123: Arbitrary file listing and deletion through the CLI
An incomplete filtering of one or more instances of special elements vulnerability [CWE-792] in the command line interpreter of FortiAP-U may allow an authenticated attacker to list and delete arbitrary files and directory via specially crafted command arguments.
Affected Software
Event History
Frequently Asked Questions
What is the severity of FG-IR-23-123?
The severity of FG-IR-23-123 is classified as critical due to the potential for arbitrary file listing and deletion by authenticated attackers.
How do I fix FG-IR-23-123?
To remediate FG-IR-23-123, upgrade FortiAP-U to version 7.0.1 or later or to version 6.2.6 or later if currently on 6.2.x.
Which versions of FortiAP-U are affected by FG-IR-23-123?
Affected versions include FortiAP-U versions prior to 7.0.1 and those from 6.2.0 to 6.2.5, as well as versions 5.4 and older.
Can an unauthenticated user exploit FG-IR-23-123?
No, the exploitation of FG-IR-23-123 requires authentication as an attacker.
What type of vulnerability is FG-IR-23-123?
FG-IR-23-123 is an incomplete filtering of special elements vulnerability, which can lead to unauthorized file access and manipulation.