Lucene search

FortinetCVE-2023-25608

HistorySep 13, 2023 - 1:15 p.m.

CVE-2023-25608

2023-09-1313:15:08

CWE-792

fortinet

web.nvd.nist.gov

cve-2023-25608

fortiap-w2

command line interpreter

vulnerability

cwe-792

file reading

nvd

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

AI Score

6.5

Confidence

High

EPSS

0.001

Percentile

28.5%

JSON

An incomplete filtering of one or more instances of special elements vulnerability [CWE-792] in the command line interpreter of FortiAP-W2 7.2.0 through 7.2.1, 7.0.3 through 7.0.5, 7.0.0 through 7.0.1, 6.4 all versions, 6.2 all versions, 6.0 all versions; FortiAP-C 5.4.0 through 5.4.4, 5.2 all versions; FortiAP 7.2.0 through 7.2.1, 7.0.0 through 7.0.5, 6.4 all versions, 6.0 all versions; FortiAP-U 7.0.0, 6.2.0 through 6.2.5, 6.0 all versions, 5.4 all versions may allow an authenticated attacker to read arbitrary files via specially crafted command arguments.

Affected configurations

Nvd

Node

fortinetfortiapRange6.0.0–7.0.6

fortinetfortiapRange7.2.0–7.2.2

fortinetfortiap-cRange5.2.0–5.4.5

fortinetfortiap-uRange5.4.0–6.2.6

fortinetfortiap-uMatch7.0.0

fortinetfortiap-w2Range6.0.0–7.0.1

fortinetfortiap-w2Range7.0.3–7.0.6

fortinetfortiap-w2Range7.2.0–7.2.2

VendorProductVersionCPE
fortinetfortiap*cpe:2.3:a:fortinet:fortiap:*:*:*:*:*:*:*:*
fortinetfortiap-c*cpe:2.3:a:fortinet:fortiap-c:*:*:*:*:*:*:*:*
fortinetfortiap-u*cpe:2.3:a:fortinet:fortiap-u:*:*:*:*:*:*:*:*
fortinetfortiap-u7.0.0cpe:2.3:a:fortinet:fortiap-u:7.0.0:*:*:*:*:*:*:*
fortinetfortiap-w2*cpe:2.3:a:fortinet:fortiap-w2:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
fortinet	fortiap	*	cpe:2.3:a:fortinet:fortiap::::::::
fortinet	fortiap-c	*	cpe:2.3:a:fortinet:fortiap-c::::::::
fortinet	fortiap-u	*	cpe:2.3:a:fortinet:fortiap-u::::::::
fortinet	fortiap-u	7.0.0	cpe:2.3:a:fortinet:fortiap-u:7.0.0:::::::*
fortinet	fortiap-w2	*	cpe:2.3:a:fortinet:fortiap-w2::::::::

CNA Affected

[
  {
    "vendor": "Fortinet",
    "product": "FortiAP-W2",
    "defaultStatus": "unaffected",
    "versions": [
      {
        "versionType": "semver",
        "version": "7.2.0",
        "lessThanOrEqual": "7.2.1",
        "status": "affected"
      },
      {
        "versionType": "semver",
        "version": "7.0.3",
        "lessThanOrEqual": "7.0.5",
        "status": "affected"
      },
      {
        "versionType": "semver",
        "version": "7.0.0",
        "lessThanOrEqual": "7.0.1",
        "status": "affected"
      },
      {
        "versionType": "semver",
        "version": "6.4.0",
        "lessThanOrEqual": "6.4.9",
        "status": "affected"
      },
      {
        "versionType": "semver",
        "version": "6.2.0",
        "lessThanOrEqual": "6.2.6",
        "status": "affected"
      },
      {
        "versionType": "semver",
        "version": "6.0.0",
        "lessThanOrEqual": "6.0.6",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "Fortinet",
    "product": "FortiAP-C",
    "defaultStatus": "unaffected",
    "versions": [
      {
        "versionType": "semver",
        "version": "5.4.0",
        "lessThanOrEqual": "5.4.4",
        "status": "affected"
      },
      {
        "versionType": "semver",
        "version": "5.2.0",
        "lessThanOrEqual": "5.2.1",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "Fortinet",
    "product": "FortiAP",
    "defaultStatus": "unaffected",
    "versions": [
      {
        "versionType": "semver",
        "version": "7.2.0",
        "lessThanOrEqual": "7.2.1",
        "status": "affected"
      },
      {
        "versionType": "semver",
        "version": "7.0.0",
        "lessThanOrEqual": "7.0.5",
        "status": "affected"
      },
      {
        "versionType": "semver",
        "version": "6.4.3",
        "lessThanOrEqual": "6.4.9",
        "status": "affected"
      },
      {
        "versionType": "semver",
        "version": "6.0.0",
        "lessThanOrEqual": "6.0.6",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "Fortinet",
    "product": "FortiAP-U",
    "defaultStatus": "unaffected",
    "versions": [
      {
        "version": "7.0.0",
        "status": "affected"
      },
      {
        "versionType": "semver",
        "version": "6.2.0",
        "lessThanOrEqual": "6.2.5",
        "status": "affected"
      },
      {
        "versionType": "semver",
        "version": "6.0.0",
        "lessThanOrEqual": "6.0.4",
        "status": "affected"
      },
      {
        "versionType": "semver",
        "version": "5.4.3",
        "lessThanOrEqual": "5.4.6",
        "status": "affected"
      },
      {
        "version": "5.4.0",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "Fortinet",
    "product": "FortiAP-S",
    "defaultStatus": "unaffected",
    "versions": [
      {
        "versionType": "semver",
        "version": "6.4.0",
        "lessThanOrEqual": "6.4.9",
        "status": "affected"
      },
      {
        "versionType": "semver",
        "version": "6.2.0",
        "lessThanOrEqual": "6.2.6",
        "status": "affected"
      },
      {
        "versionType": "semver",
        "version": "6.0.0",
        "lessThanOrEqual": "6.0.6",
        "status": "affected"
      }
    ]
  }
]

References

fortiguard.com/psirt/FG-IR-22-120

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

AI Score

6.5

Confidence

High

EPSS

0.001

Percentile

28.5%

JSON

Related for CVE-2023-25608