Vulnerability-Lookup

CVE-2025-53870 (GCVE-0-2025-53870)

Vulnerability from cvelistv5 – Published: 2026-05-12 16:54 – Updated: 2026-05-13 03:58

Summary

An improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiAP 7.6.0 through 7.6.2, FortiAP 7.4.0 through 7.4.5, FortiAP 7.2 all versions, FortiAP 7.0 all versions, FortiAP 6.4 all versions, FortiAP-W2 7.4.0 through 7.4.4, FortiAP-W2 7.2 all versions, FortiAP-W2 7.0 all versions may allow an authenticated attacker to execute unauthorized code or commands via a specifically crafted cli command.

Severity ?

6.5 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C

CWE

CWE-78 - Escalation of privilege

Assigner

fortinet

References

1 reference

URL	Tags
https://fortiguard.fortinet.com/psirt/FG-IR-26-133

Impacted products

2 products

Vendor	Product	Version
Fortinet	FortiAP	Affected: 7.6.0 , ≤ 7.6.2 (semver) Affected: 7.4.0 , ≤ 7.4.5 (semver) Affected: 7.2.0 , ≤ 7.2.6 (semver) Affected: 7.0.0 , ≤ 7.0.7 (semver) Affected: 6.4.3 , ≤ 6.4.9 (semver) cpe:2.3:a:fortinet:fortiap:7.6.2:::::::* cpe:2.3:a:fortinet:fortiap:7.6.1:::::::* cpe:2.3:a:fortinet:fortiap:7.6.0:::::::* cpe:2.3:a:fortinet:fortiap:7.4.5:::::::* cpe:2.3:a:fortinet:fortiap:7.4.4:::::::* cpe:2.3:a:fortinet:fortiap:7.4.3:::::::* cpe:2.3:a:fortinet:fortiap:7.4.2:::::::* cpe:2.3:a:fortinet:fortiap:7.4.1:::::::* cpe:2.3:a:fortinet:fortiap:7.4.0:::::::* cpe:2.3:a:fortinet:fortiap:7.2.6:::::::* cpe:2.3:a:fortinet:fortiap:7.2.5:::::::* cpe:2.3:a:fortinet:fortiap:7.2.4:::::::* cpe:2.3:a:fortinet:fortiap:7.2.3:::::::* cpe:2.3:a:fortinet:fortiap:7.2.2:::::::* cpe:2.3:a:fortinet:fortiap:7.2.1:::::::* cpe:2.3:a:fortinet:fortiap:7.2.0:::::::* cpe:2.3:a:fortinet:fortiap:7.0.7:::::::* cpe:2.3:a:fortinet:fortiap:7.0.6:::::::* cpe:2.3:a:fortinet:fortiap:7.0.5:::::::* cpe:2.3:a:fortinet:fortiap:7.0.4:::::::* cpe:2.3:a:fortinet:fortiap:7.0.3:::::::* cpe:2.3:a:fortinet:fortiap:7.0.2:::::::* cpe:2.3:a:fortinet:fortiap:7.0.1:::::::* cpe:2.3:a:fortinet:fortiap:7.0.0:::::::* cpe:2.3:a:fortinet:fortiap:6.4.9:::::::* cpe:2.3:a:fortinet:fortiap:6.4.8:::::::* cpe:2.3:a:fortinet:fortiap:6.4.7:::::::* cpe:2.3:a:fortinet:fortiap:6.4.6:::::::* cpe:2.3:a:fortinet:fortiap:6.4.5:::::::* cpe:2.3:a:fortinet:fortiap:6.4.4:::::::* cpe:2.3:a:fortinet:fortiap:6.4.3:::::::*
Fortinet	FortiAP-W2	Affected: 7.4.0 , ≤ 7.4.4 (semver) Affected: 7.2.0 , ≤ 7.2.5 (semver) Affected: 7.0.0 , ≤ 7.0.8 (semver) cpe:2.3:a:fortinet:fortiap-w2:7.4.4:::::::* cpe:2.3:a:fortinet:fortiap-w2:7.4.3:::::::* cpe:2.3:a:fortinet:fortiap-w2:7.4.2:::::::* cpe:2.3:a:fortinet:fortiap-w2:7.4.1:::::::* cpe:2.3:a:fortinet:fortiap-w2:7.4.0:::::::* cpe:2.3:a:fortinet:fortiap-w2:7.2.5:::::::* cpe:2.3:a:fortinet:fortiap-w2:7.2.4:::::::* cpe:2.3:a:fortinet:fortiap-w2:7.2.3:::::::* cpe:2.3:a:fortinet:fortiap-w2:7.2.2:::::::* cpe:2.3:a:fortinet:fortiap-w2:7.2.1:::::::* cpe:2.3:a:fortinet:fortiap-w2:7.2.0:::::::* cpe:2.3:a:fortinet:fortiap-w2:7.0.8:::::::* cpe:2.3:a:fortinet:fortiap-w2:7.0.7:::::::* cpe:2.3:a:fortinet:fortiap-w2:7.0.6:::::::* cpe:2.3:a:fortinet:fortiap-w2:7.0.5:::::::* cpe:2.3:a:fortinet:fortiap-w2:7.0.4:::::::* cpe:2.3:a:fortinet:fortiap-w2:7.0.3:::::::* cpe:2.3:a:fortinet:fortiap-w2:7.0.2:::::::* cpe:2.3:a:fortinet:fortiap-w2:7.0.1:::::::* cpe:2.3:a:fortinet:fortiap-w2:7.0.0:::::::*

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-53870",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-12T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-13T03:58:24.463Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:fortinet:fortiap:7.6.2:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiap:7.6.1:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiap:7.6.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiap:7.4.5:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiap:7.4.4:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiap:7.4.3:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiap:7.4.2:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiap:7.4.1:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiap:7.4.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiap:7.2.6:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiap:7.2.5:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiap:7.2.4:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiap:7.2.3:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiap:7.2.2:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiap:7.2.1:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiap:7.2.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiap:7.0.7:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiap:7.0.6:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiap:7.0.5:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiap:7.0.4:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiap:7.0.3:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiap:7.0.2:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiap:7.0.1:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiap:7.0.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiap:6.4.9:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiap:6.4.8:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiap:6.4.7:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiap:6.4.6:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiap:6.4.5:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiap:6.4.4:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiap:6.4.3:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "product": "FortiAP",
          "vendor": "Fortinet",
          "versions": [
            {
              "lessThanOrEqual": "7.6.2",
              "status": "affected",
              "version": "7.6.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.4.5",
              "status": "affected",
              "version": "7.4.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.6",
              "status": "affected",
              "version": "7.2.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.7",
              "status": "affected",
              "version": "7.0.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.4.9",
              "status": "affected",
              "version": "6.4.3",
              "versionType": "semver"
            }
          ]
        },
        {
          "cpes": [
            "cpe:2.3:a:fortinet:fortiap-w2:7.4.4:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiap-w2:7.4.3:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiap-w2:7.4.2:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiap-w2:7.4.1:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiap-w2:7.4.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiap-w2:7.2.5:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiap-w2:7.2.4:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiap-w2:7.2.3:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiap-w2:7.2.2:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiap-w2:7.2.1:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiap-w2:7.2.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiap-w2:7.0.8:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiap-w2:7.0.7:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiap-w2:7.0.6:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiap-w2:7.0.5:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiap-w2:7.0.4:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiap-w2:7.0.3:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiap-w2:7.0.2:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiap-w2:7.0.1:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiap-w2:7.0.0:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "product": "FortiAP-W2",
          "vendor": "Fortinet",
          "versions": [
            {
              "lessThanOrEqual": "7.4.4",
              "status": "affected",
              "version": "7.4.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.5",
              "status": "affected",
              "version": "7.2.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.8",
              "status": "affected",
              "version": "7.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "An improper neutralization of special elements used in an os command (\u0027os command injection\u0027) vulnerability in Fortinet FortiAP 7.6.0 through 7.6.2, FortiAP 7.4.0 through 7.4.5, FortiAP 7.2 all versions, FortiAP 7.0 all versions, FortiAP 6.4 all versions, FortiAP-W2 7.4.0 through 7.4.4, FortiAP-W2 7.2 all versions, FortiAP-W2 7.0 all versions may allow  an authenticated attacker to execute unauthorized code or commands via a specifically crafted cli command."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-78",
              "description": "Escalation of privilege",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-12T16:54:32.010Z",
        "orgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8",
        "shortName": "fortinet"
      },
      "references": [
        {
          "name": "https://fortiguard.fortinet.com/psirt/FG-IR-26-133",
          "url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-133"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "Upgrade to FortiAP version 7.6.3 or above\nUpgrade to FortiAP version 7.4.6 or above\nUpgrade to FortiAP-U version 7.0.6 or above\nUpgrade to FortiAP-W2 version 7.4.5 or above"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8",
    "assignerShortName": "fortinet",
    "cveId": "CVE-2025-53870",
    "datePublished": "2026-05-12T16:54:32.010Z",
    "dateReserved": "2025-07-11T07:30:58.396Z",
    "dateUpdated": "2026-05-13T03:58:24.463Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-53870",
      "date": "2026-05-17",
      "epss": "0.0003",
      "percentile": "0.08665"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-53870\",\"sourceIdentifier\":\"psirt@fortinet.com\",\"published\":\"2026-05-12T18:16:36.140\",\"lastModified\":\"2026-05-15T14:15:53.040\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"An improper neutralization of special elements used in an os command (\u0027os command injection\u0027) vulnerability in Fortinet FortiAP 7.6.0 through 7.6.2, FortiAP 7.4.0 through 7.4.5, FortiAP 7.2 all versions, FortiAP 7.0 all versions, FortiAP 6.4 all versions, FortiAP-W2 7.4.0 through 7.4.4, FortiAP-W2 7.2 all versions, FortiAP-W2 7.0 all versions may allow  an authenticated attacker to execute unauthorized code or commands via a specifically crafted cli command.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"psirt@fortinet.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":6.7,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"HIGH\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":0.8,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"psirt@fortinet.com\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-78\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:fortinet:fortiap:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.4.0\",\"versionEndExcluding\":\"7.4.6\",\"matchCriteriaId\":\"18EEF706-844E-42A4-A8A7-A76EDFD75CA5\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:fortinet:fortiap:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"7.6.0\",\"versionEndExcluding\":\"7.6.3\",\"matchCriteriaId\":\"4CC1B150-4BDE-473A-833E-C680933B585F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:fortinet:fortiap-w2:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"7.2.0\",\"versionEndExcluding\":\"7.2.6\",\"matchCriteriaId\":\"698B2A95-2110-4584-8648-F8DE6ADBC75E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:fortinet:fortiap-w2:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"7.4.0\",\"versionEndExcluding\":\"7.4.5\",\"matchCriteriaId\":\"3874C47E-B5F5-47E1-8A90-F376B8975BDE\"}]}]}],\"references\":[{\"url\":\"https://fortiguard.fortinet.com/psirt/FG-IR-26-133\",\"source\":\"psirt@fortinet.com\",\"tags\":[\"Vendor Advisory\"]}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2025-53870\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-05-12T19:00:44.839104Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-05-12T19:01:45.473Z\"}}], \"cna\": {\"metrics\": [{\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 6.5, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"HIGH\", \"confidentialityImpact\": \"HIGH\"}}], \"affected\": [{\"cpes\": [\"cpe:2.3:a:fortinet:fortiap:7.6.2:*:*:*:*:*:*:*\", \"cpe:2.3:a:fortinet:fortiap:7.6.1:*:*:*:*:*:*:*\", \"cpe:2.3:a:fortinet:fortiap:7.6.0:*:*:*:*:*:*:*\", \"cpe:2.3:a:fortinet:fortiap:7.4.5:*:*:*:*:*:*:*\", \"cpe:2.3:a:fortinet:fortiap:7.4.4:*:*:*:*:*:*:*\", \"cpe:2.3:a:fortinet:fortiap:7.4.3:*:*:*:*:*:*:*\", \"cpe:2.3:a:fortinet:fortiap:7.4.2:*:*:*:*:*:*:*\", \"cpe:2.3:a:fortinet:fortiap:7.4.1:*:*:*:*:*:*:*\", \"cpe:2.3:a:fortinet:fortiap:7.4.0:*:*:*:*:*:*:*\", \"cpe:2.3:a:fortinet:fortiap:7.2.6:*:*:*:*:*:*:*\", \"cpe:2.3:a:fortinet:fortiap:7.2.5:*:*:*:*:*:*:*\", \"cpe:2.3:a:fortinet:fortiap:7.2.4:*:*:*:*:*:*:*\", \"cpe:2.3:a:fortinet:fortiap:7.2.3:*:*:*:*:*:*:*\", \"cpe:2.3:a:fortinet:fortiap:7.2.2:*:*:*:*:*:*:*\", \"cpe:2.3:a:fortinet:fortiap:7.2.1:*:*:*:*:*:*:*\", \"cpe:2.3:a:fortinet:fortiap:7.2.0:*:*:*:*:*:*:*\", \"cpe:2.3:a:fortinet:fortiap:7.0.7:*:*:*:*:*:*:*\", \"cpe:2.3:a:fortinet:fortiap:7.0.6:*:*:*:*:*:*:*\", \"cpe:2.3:a:fortinet:fortiap:7.0.5:*:*:*:*:*:*:*\", \"cpe:2.3:a:fortinet:fortiap:7.0.4:*:*:*:*:*:*:*\", \"cpe:2.3:a:fortinet:fortiap:7.0.3:*:*:*:*:*:*:*\", \"cpe:2.3:a:fortinet:fortiap:7.0.2:*:*:*:*:*:*:*\", \"cpe:2.3:a:fortinet:fortiap:7.0.1:*:*:*:*:*:*:*\", \"cpe:2.3:a:fortinet:fortiap:7.0.0:*:*:*:*:*:*:*\", \"cpe:2.3:a:fortinet:fortiap:6.4.9:*:*:*:*:*:*:*\", \"cpe:2.3:a:fortinet:fortiap:6.4.8:*:*:*:*:*:*:*\", \"cpe:2.3:a:fortinet:fortiap:6.4.7:*:*:*:*:*:*:*\", \"cpe:2.3:a:fortinet:fortiap:6.4.6:*:*:*:*:*:*:*\", \"cpe:2.3:a:fortinet:fortiap:6.4.5:*:*:*:*:*:*:*\", \"cpe:2.3:a:fortinet:fortiap:6.4.4:*:*:*:*:*:*:*\", \"cpe:2.3:a:fortinet:fortiap:6.4.3:*:*:*:*:*:*:*\"], \"vendor\": \"Fortinet\", \"product\": \"FortiAP\", \"versions\": [{\"status\": \"affected\", \"version\": \"7.6.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.6.2\"}, {\"status\": \"affected\", \"version\": \"7.4.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.4.5\"}, {\"status\": \"affected\", \"version\": \"7.2.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.2.6\"}, {\"status\": \"affected\", \"version\": \"7.0.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.0.7\"}, {\"status\": \"affected\", \"version\": \"6.4.3\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.4.9\"}], \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:2.3:a:fortinet:fortiap-w2:7.4.4:*:*:*:*:*:*:*\", \"cpe:2.3:a:fortinet:fortiap-w2:7.4.3:*:*:*:*:*:*:*\", \"cpe:2.3:a:fortinet:fortiap-w2:7.4.2:*:*:*:*:*:*:*\", \"cpe:2.3:a:fortinet:fortiap-w2:7.4.1:*:*:*:*:*:*:*\", \"cpe:2.3:a:fortinet:fortiap-w2:7.4.0:*:*:*:*:*:*:*\", \"cpe:2.3:a:fortinet:fortiap-w2:7.2.5:*:*:*:*:*:*:*\", \"cpe:2.3:a:fortinet:fortiap-w2:7.2.4:*:*:*:*:*:*:*\", \"cpe:2.3:a:fortinet:fortiap-w2:7.2.3:*:*:*:*:*:*:*\", \"cpe:2.3:a:fortinet:fortiap-w2:7.2.2:*:*:*:*:*:*:*\", \"cpe:2.3:a:fortinet:fortiap-w2:7.2.1:*:*:*:*:*:*:*\", \"cpe:2.3:a:fortinet:fortiap-w2:7.2.0:*:*:*:*:*:*:*\", \"cpe:2.3:a:fortinet:fortiap-w2:7.0.8:*:*:*:*:*:*:*\", \"cpe:2.3:a:fortinet:fortiap-w2:7.0.7:*:*:*:*:*:*:*\", \"cpe:2.3:a:fortinet:fortiap-w2:7.0.6:*:*:*:*:*:*:*\", \"cpe:2.3:a:fortinet:fortiap-w2:7.0.5:*:*:*:*:*:*:*\", \"cpe:2.3:a:fortinet:fortiap-w2:7.0.4:*:*:*:*:*:*:*\", \"cpe:2.3:a:fortinet:fortiap-w2:7.0.3:*:*:*:*:*:*:*\", \"cpe:2.3:a:fortinet:fortiap-w2:7.0.2:*:*:*:*:*:*:*\", \"cpe:2.3:a:fortinet:fortiap-w2:7.0.1:*:*:*:*:*:*:*\", \"cpe:2.3:a:fortinet:fortiap-w2:7.0.0:*:*:*:*:*:*:*\"], \"vendor\": \"Fortinet\", \"product\": \"FortiAP-W2\", \"versions\": [{\"status\": \"affected\", \"version\": \"7.4.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.4.4\"}, {\"status\": \"affected\", \"version\": \"7.2.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.2.5\"}, {\"status\": \"affected\", \"version\": \"7.0.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.0.8\"}], \"defaultStatus\": \"unaffected\"}], \"solutions\": [{\"lang\": \"en\", \"value\": \"Upgrade to FortiAP version 7.6.3 or above\\nUpgrade to FortiAP version 7.4.6 or above\\nUpgrade to FortiAP-U version 7.0.6 or above\\nUpgrade to FortiAP-W2 version 7.4.5 or above\"}], \"references\": [{\"url\": \"https://fortiguard.fortinet.com/psirt/FG-IR-26-133\", \"name\": \"https://fortiguard.fortinet.com/psirt/FG-IR-26-133\"}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"An improper neutralization of special elements used in an os command (\u0027os command injection\u0027) vulnerability in Fortinet FortiAP 7.6.0 through 7.6.2, FortiAP 7.4.0 through 7.4.5, FortiAP 7.2 all versions, FortiAP 7.0 all versions, FortiAP 6.4 all versions, FortiAP-W2 7.4.0 through 7.4.4, FortiAP-W2 7.2 all versions, FortiAP-W2 7.0 all versions may allow  an authenticated attacker to execute unauthorized code or commands via a specifically crafted cli command.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-78\", \"description\": \"Escalation of privilege\"}]}], \"providerMetadata\": {\"orgId\": \"6abe59d8-c742-4dff-8ce8-9b0ca1073da8\", \"shortName\": \"fortinet\", \"dateUpdated\": \"2026-05-12T16:54:32.010Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2025-53870\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-05-13T03:58:24.463Z\", \"dateReserved\": \"2025-07-11T07:30:58.396Z\", \"assignerOrgId\": \"6abe59d8-c742-4dff-8ce8-9b0ca1073da8\", \"datePublished\": \"2026-05-12T16:54:32.010Z\", \"assignerShortName\": \"fortinet\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

CERTFR-2026-AVI-0575

Vulnerability from certfr_avis - Published: 2026-05-13 - Updated: 2026-05-13

De multiples vulnérabilités ont été découvertes dans les produits Fortinet. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, une élévation de privilèges et un déni de service à distance.

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Impacted products

Vendor	Product	Description
Fortinet	FortiOS	FortiOS versions 7.6.x antérieures à 7.6.4
Fortinet	FortiAP	FortiAP-W2 versions antérieures à 7.4.5
Fortinet	FortiMail	FortiMail versions 7.6.x antérieures à 7.6.4
Fortinet	FortiAnalyzer	FortiAnalyzer versions 7.6.x antérieures à 7.6.5
Fortinet	FortiSandbox	FortiSandbox PaaS 21.x, 22.x, et 23.x toutes versions
Fortinet	FortiSandbox	FortiSandbox PaaS versions 4.4.x antérieures à 4.4.9
Fortinet	FortiAP	FortiAP versions 7.6.x antérieures à 7.6.3
Fortinet	FortiAP	FortiAP-U versions 7.0.x antérieures à 7.0.6
Fortinet	FortiDeceptor	FortiDeceptor versions 5.x et 6.x antérieures à 6.1
Fortinet	FortiSandbox	FortiSandbox Cloud 24 toutes versions
Fortinet	FortiManager	FortiManager versions 7.6.x antérieures à 7.6.5
Fortinet	FortiClient	FortiClientWindows versions antérieures à 7.4.3
Fortinet	FortiSandbox	FortiSandbox versions 4.4.x antérieures à 4.4.9
Fortinet	FortiOS	FortiOS versions 7.4.x antérieures à 7.4.9
Fortinet	FortiOS	FortiOS versions 7.2.x antérieures à 7.2.12
Fortinet	FortiMail	FortiMail versions 7.4.x antérieures à 7.4.6
Fortinet	FortiSandbox	FortiSandbox versions 5.x antérieures à 5.0.2
Fortinet	N/A	FortiTokenAndroid versions antérieures à 6.4
Fortinet	FortiAuthenticator	FortiAuthenticator versions 6.5.x antérieures à 6.5.7
Fortinet	FortiManager	FortiManager versions antérieures à 7.4.9
Fortinet	FortiSandbox	FortiSandbox Cloud 23 toutes versions
Fortinet	FortiNDR	FortiNDR versions 7.6.x antérieures à 7.6.3
Fortinet	FortiSandbox	FortiSandbox Cloud versions 5.x antérieures à 5.0.6
Fortinet	FortiAuthenticator	FortiAuthenticator versions 6.6.x antérieures à 6.6.9
Fortinet	FortiAnalyzer	FortiAnalyzer versions antérieures à 7.4.9
Fortinet	FortiMail	FortiMail versions 7.2.x antérieures à 7.2.9
Fortinet	FortiNDR	FortiNDR versions 7.x antérieures à 7.4.10
Fortinet	FortiAP	FortiAP versions antérieures à 7.4.6
Fortinet	FortiSandbox	FortiSandbox PaaS versions 5.0.x antérieures à 5.0.2
Fortinet	FortiAuthenticator	FortiAuthenticator versions 8.0.x antérieures à 8.0.3

References

Title

Publication Time

Tags

Bulletin de sécurité Fortinet FG-IR-26-137	2026-05-12	vendor-advisory
Bulletin de sécurité Fortinet FG-IR-26-133	2026-05-12	vendor-advisory
Bulletin de sécurité Fortinet FG-IR-26-138	2026-05-12	vendor-advisory
Bulletin de sécurité Fortinet FG-IR-26-130	2026-05-12	vendor-advisory
Bulletin de sécurité Fortinet FG-IR-26-134	2026-05-12	vendor-advisory
Bulletin de sécurité Fortinet FG-IR-26-136	2026-05-12	vendor-advisory
Bulletin de sécurité Fortinet FG-IR-26-123	2026-05-12	vendor-advisory
Bulletin de sécurité Fortinet FG-IR-26-129	2026-05-12	vendor-advisory
Bulletin de sécurité Fortinet FG-IR-26-128	2026-05-12	vendor-advisory
Bulletin de sécurité Fortinet FG-IR-26-132	2026-05-12	vendor-advisory
Bulletin de sécurité Fortinet FG-IR-26-131	2026-05-12	vendor-advisory

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "FortiOS versions 7.6.x ant\u00e9rieures \u00e0 7.6.4",
      "product": {
        "name": "FortiOS",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiAP-W2 versions ant\u00e9rieures \u00e0 7.4.5",
      "product": {
        "name": "FortiAP",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiMail versions 7.6.x ant\u00e9rieures \u00e0 7.6.4",
      "product": {
        "name": "FortiMail",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiAnalyzer versions 7.6.x ant\u00e9rieures \u00e0 7.6.5",
      "product": {
        "name": "FortiAnalyzer",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiSandbox PaaS 21.x, 22.x, et 23.x toutes versions",
      "product": {
        "name": "FortiSandbox",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiSandbox PaaS versions 4.4.x ant\u00e9rieures \u00e0 4.4.9",
      "product": {
        "name": "FortiSandbox",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiAP versions 7.6.x ant\u00e9rieures \u00e0 7.6.3",
      "product": {
        "name": "FortiAP",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiAP-U versions 7.0.x ant\u00e9rieures \u00e0 7.0.6",
      "product": {
        "name": "FortiAP",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiDeceptor versions 5.x et 6.x ant\u00e9rieures \u00e0 6.1",
      "product": {
        "name": "FortiDeceptor",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiSandbox Cloud 24 toutes versions",
      "product": {
        "name": "FortiSandbox",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiManager versions 7.6.x ant\u00e9rieures \u00e0 7.6.5",
      "product": {
        "name": "FortiManager",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiClientWindows versions ant\u00e9rieures \u00e0 7.4.3",
      "product": {
        "name": "FortiClient",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiSandbox versions 4.4.x ant\u00e9rieures \u00e0 4.4.9",
      "product": {
        "name": "FortiSandbox",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiOS versions 7.4.x ant\u00e9rieures \u00e0 7.4.9",
      "product": {
        "name": "FortiOS",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiOS versions 7.2.x ant\u00e9rieures \u00e0 7.2.12",
      "product": {
        "name": "FortiOS",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiMail versions 7.4.x ant\u00e9rieures \u00e0 7.4.6",
      "product": {
        "name": "FortiMail",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiSandbox versions 5.x ant\u00e9rieures \u00e0 5.0.2",
      "product": {
        "name": "FortiSandbox",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiTokenAndroid versions ant\u00e9rieures \u00e0 6.4",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiAuthenticator versions 6.5.x ant\u00e9rieures \u00e0 6.5.7",
      "product": {
        "name": "FortiAuthenticator",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiManager versions ant\u00e9rieures \u00e0 7.4.9",
      "product": {
        "name": "FortiManager",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiSandbox Cloud 23 toutes versions",
      "product": {
        "name": "FortiSandbox",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiNDR versions 7.6.x ant\u00e9rieures \u00e0 7.6.3",
      "product": {
        "name": "FortiNDR",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiSandbox Cloud versions 5.x ant\u00e9rieures \u00e0 5.0.6",
      "product": {
        "name": "FortiSandbox",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiAuthenticator versions 6.6.x ant\u00e9rieures \u00e0 6.6.9",
      "product": {
        "name": "FortiAuthenticator",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiAnalyzer versions ant\u00e9rieures \u00e0 7.4.9",
      "product": {
        "name": "FortiAnalyzer",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiMail versions 7.2.x ant\u00e9rieures \u00e0 7.2.9",
      "product": {
        "name": "FortiMail",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiNDR versions 7.x ant\u00e9rieures \u00e0 7.4.10",
      "product": {
        "name": "FortiNDR",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiAP versions ant\u00e9rieures \u00e0 7.4.6",
      "product": {
        "name": "FortiAP",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiSandbox PaaS versions 5.0.x ant\u00e9rieures \u00e0 5.0.2",
      "product": {
        "name": "FortiSandbox",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiAuthenticator versions 8.0.x ant\u00e9rieures \u00e0 8.0.3",
      "product": {
        "name": "FortiAuthenticator",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [
    {
      "name": "CVE-2026-44279",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-44279"
    },
    {
      "name": "CVE-2026-25690",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-25690"
    },
    {
      "name": "CVE-2026-44277",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-44277"
    },
    {
      "name": "CVE-2025-53844",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-53844"
    },
    {
      "name": "CVE-2025-53681",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-53681"
    },
    {
      "name": "CVE-2026-26083",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-26083"
    },
    {
      "name": "CVE-2025-67604",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-67604"
    },
    {
      "name": "CVE-2026-44278",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-44278"
    },
    {
      "name": "CVE-2025-53680",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-53680"
    },
    {
      "name": "CVE-2025-53870",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-53870"
    },
    {
      "name": "CVE-2026-25088",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-25088"
    }
  ],
  "initial_release_date": "2026-05-13T00:00:00",
  "last_revision_date": "2026-05-13T00:00:00",
  "links": [],
  "reference": "CERTFR-2026-AVI-0575",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2026-05-13T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    },
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    },
    {
      "description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
    },
    {
      "description": "Injection SQL (SQLi)"
    },
    {
      "description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    },
    {
      "description": "\u00c9l\u00e9vation de privil\u00e8ges"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits Fortinet. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance, une \u00e9l\u00e9vation de privil\u00e8ges et un d\u00e9ni de service \u00e0 distance.",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Fortinet",
  "vendor_advisories": [
    {
      "published_at": "2026-05-12",
      "title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-26-137",
      "url": "https://www.fortiguard.com/psirt/FG-IR-26-137"
    },
    {
      "published_at": "2026-05-12",
      "title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-26-133",
      "url": "https://www.fortiguard.com/psirt/FG-IR-26-133"
    },
    {
      "published_at": "2026-05-12",
      "title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-26-138",
      "url": "https://www.fortiguard.com/psirt/FG-IR-26-138"
    },
    {
      "published_at": "2026-05-12",
      "title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-26-130",
      "url": "https://www.fortiguard.com/psirt/FG-IR-26-130"
    },
    {
      "published_at": "2026-05-12",
      "title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-26-134",
      "url": "https://www.fortiguard.com/psirt/FG-IR-26-134"
    },
    {
      "published_at": "2026-05-12",
      "title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-26-136",
      "url": "https://www.fortiguard.com/psirt/FG-IR-26-136"
    },
    {
      "published_at": "2026-05-12",
      "title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-26-123",
      "url": "https://www.fortiguard.com/psirt/FG-IR-26-123"
    },
    {
      "published_at": "2026-05-12",
      "title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-26-129",
      "url": "https://www.fortiguard.com/psirt/FG-IR-26-129"
    },
    {
      "published_at": "2026-05-12",
      "title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-26-128",
      "url": "https://www.fortiguard.com/psirt/FG-IR-26-128"
    },
    {
      "published_at": "2026-05-12",
      "title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-26-132",
      "url": "https://www.fortiguard.com/psirt/FG-IR-26-132"
    },
    {
      "published_at": "2026-05-12",
      "title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-26-131",
      "url": "https://www.fortiguard.com/psirt/FG-IR-26-131"
    }
  ]
}

GHSA-RQ62-F8QM-52R7

Vulnerability from github – Published: 2026-05-12 18:30 – Updated: 2026-05-12 18:30

Details

Severity ?

6.7 (Medium)


                  
                    CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2025-53870"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-78"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-05-12T18:16:36Z",
    "severity": "MODERATE"
  },
  "details": "An improper neutralization of special elements used in an os command (\u0027os command injection\u0027) vulnerability in Fortinet FortiAP 7.6.0 through 7.6.2, FortiAP 7.4.0 through 7.4.5, FortiAP 7.2 all versions, FortiAP 7.0 all versions, FortiAP 6.4 all versions, FortiAP-W2 7.4.0 through 7.4.4, FortiAP-W2 7.2 all versions, FortiAP-W2 7.0 all versions may allow  an authenticated attacker to execute unauthorized code or commands via a specifically crafted cli command.",
  "id": "GHSA-rq62-f8qm-52r7",
  "modified": "2026-05-12T18:30:40Z",
  "published": "2026-05-12T18:30:40Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-53870"
    },
    {
      "type": "WEB",
      "url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-133"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

FKIE_CVE-2025-53870

Vulnerability from fkie_nvd - Published: 2026-05-12 18:16 - Updated: 2026-05-15 14:15

Severity ?

6.7 (Medium) - CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Summary

References

	URL	Tags
	psirt@fortinet.com	https://fortiguard.fortinet.com/psirt/FG-IR-26-133	Vendor Advisory

Impacted products

Vendor	Product	Version
fortinet	fortiap	*
fortinet	fortiap	*
fortinet	fortiap-w2	*
fortinet	fortiap-w2	*

JSON

To clipboard

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:fortinet:fortiap:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "18EEF706-844E-42A4-A8A7-A76EDFD75CA5",
              "versionEndExcluding": "7.4.6",
              "versionStartIncluding": "6.4.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:fortinet:fortiap:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "4CC1B150-4BDE-473A-833E-C680933B585F",
              "versionEndExcluding": "7.6.3",
              "versionStartIncluding": "7.6.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:fortinet:fortiap-w2:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "698B2A95-2110-4584-8648-F8DE6ADBC75E",
              "versionEndExcluding": "7.2.6",
              "versionStartIncluding": "7.2.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:fortinet:fortiap-w2:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "3874C47E-B5F5-47E1-8A90-F376B8975BDE",
              "versionEndExcluding": "7.4.5",
              "versionStartIncluding": "7.4.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "An improper neutralization of special elements used in an os command (\u0027os command injection\u0027) vulnerability in Fortinet FortiAP 7.6.0 through 7.6.2, FortiAP 7.4.0 through 7.4.5, FortiAP 7.2 all versions, FortiAP 7.0 all versions, FortiAP 6.4 all versions, FortiAP-W2 7.4.0 through 7.4.4, FortiAP-W2 7.2 all versions, FortiAP-W2 7.0 all versions may allow  an authenticated attacker to execute unauthorized code or commands via a specifically crafted cli command."
    }
  ],
  "id": "CVE-2025-53870",
  "lastModified": "2026-05-15T14:15:53.040",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "HIGH",
          "baseScore": 6.7,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "HIGH",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 0.8,
        "impactScore": 5.9,
        "source": "psirt@fortinet.com",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-05-12T18:16:36.140",
  "references": [
    {
      "source": "psirt@fortinet.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-133"
    }
  ],
  "sourceIdentifier": "psirt@fortinet.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-78"
        }
      ],
      "source": "psirt@fortinet.com",
      "type": "Primary"
    }
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2025-53870 (GCVE-0-2025-53870)

CERTFR-2026-AVI-0575

Solutions

GHSA-RQ62-F8QM-52R7

FKIE_CVE-2025-53870

Tags

Sightings

Nomenclature