FG-IR-24-110: OS Command Injection in administrative interface
Published Mar 11, 2025
·Updated
Multiple improper neutralization of special elements used in an OS Command vulnerabilities [CWE-78] in FortiSandbox may allow a privileged attacker to execute unauthorized commands via crafted requests.
Affected Software
4 affected componentsFixes available
Fortinet FortiSandbox>=4.4.0<=4.4.5
Fortinet FortiSandbox>=4.2
Fortinet FortiSandbox>=4.0
Fortinet FortiSandbox>=3.2
Event History
Mar 11, 2025
Advisory Published
via FortiGuard·12:00 AM
Frequently Asked Questions
1
What is the severity of FG-IR-24-110?
The severity of FG-IR-24-110 is high due to the potential for unauthorized command execution by a privileged attacker.
2
How do I fix FG-IR-24-110?
To fix FG-IR-24-110, upgrade your FortiSandbox to version 4.4.6 or later.
3
Which versions of FortiSandbox are affected by FG-IR-24-110?
FortiSandbox versions from 4.4.0 to 4.4.5, and older versions such as 4.2, 4.0, and 3.2 are affected by FG-IR-24-110.
4
What type of vulnerability is FG-IR-24-110?
FG-IR-24-110 is categorized as multiple improper neutralization of special elements used in an OS command vulnerability.
5
Who is the vendor associated with FG-IR-24-110?
The vendor associated with FG-IR-24-110 is Fortinet.