HIGH🇵🇱 Wersja polska

CVE-2025-53949

CVSS 7.2v3.1pub. 2025-12-09

An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability [CWE-78] vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.2, FortiSandbox 4.4.0 through 4.4.7, FortiSandbox 4.2 all versions, FortiSandbox 4.0 all versions may allow an authenticated attacker to execute unauthorized code on the underlying system via crafted HTTP requests.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

  • Fortinet Fortisandbox

    APP
    Fortinet
    4.0.0 – 4.0.64.2.0 – 4.2.84.4.0 – 4.4.75.0.0 – 5.0.2
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
Command Injection
CWE
References

Related vulnerabilities

CVE-2026-25089CRITICAL9.8PL ✓ten sam produkt

Command injection w Fortinet FortiSandbox — dostęp bez uwierzytelnienia

CVE-2026-26083CRITICAL9.8PL ✓ten sam produkt

Brak autoryzacji w Fortinet FortiSandbox umożliwia zdalne wykonanie kodu

CVE-2026-39813CRITICAL9.8ten sam produkt

A path traversal: '../filedir' vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4.0 ...

CVE-2026-39808CRITICAL9.8PL ✓ten sam produkt

Command Injection w Fortinet FortiSandbox umożliwiający RCE

CVE-2025-52436HIGH8.8ten sam produkt

An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability [CWE-79]...

CVE-2025-53949 — Fortinet — Fortisandbox — HIGH — CVSS 7.2 | CVEbaza.pl