CVE-2023-25608
Description
An incomplete filtering of one or more instances of special elements vulnerability [CWE-792] in the command line interpreter of FortiAP-W2 7.2.0 through 7.2.1, 7.0.3 through 7.0.5, 7.0.0 through 7.0.1, 6.4 all versions, 6.2 all versions, 6.0 all versions; FortiAP-C 5.4.0 through 5.4.4, 5.2 all versions; FortiAP 7.2.0 through 7.2.1, 7.0.0 through 7.0.5, 6.4 all versions, 6.0 all versions; FortiAP-U 7.0.0, 6.2.0 through 6.2.5, 6.0 all versions, 5.4 all versions may allow an authenticated attacker to read arbitrary files via specially crafted command arguments.
How to fix
- fortinet fortiap7.0.6, 7.2.2 or later
- fortinet fortiap-c5.4.5 or later
- fortinet fortiap-u6.2.6 or later
- fortinet fortiap-w27.0.6, 7.2.2 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| fortinet fortiap | 6.0.0 ≤ v < 7.0.6, 7.2.0 ≤ v < 7.2.2 | 7.0.6, 7.2.2 |
| fortinet fortiap-c | 5.2.0 ≤ v < 5.4.5 | 5.4.5 |
| fortinet fortiap-u | 5.4.0 ≤ v < 6.2.6, 7.0.0 | 6.2.6 |
| fortinet fortiap-w2 | 6.0.0 ≤ v ≤ 7.0.1, 7.0.3 ≤ v < 7.0.6, 7.2.0 ≤ v < 7.2.2 | 7.0.6, 7.2.2 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.