CVE-2024-27778

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-27778
An improper neutralization of special elements used in an OS Command vulnerability [CWE-78] vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.4, FortiSandbox 4.2.1 through 4.2.6, FortiSandbox 4.0.0 through 4.0.4, FortiSandbox 3.2 all versions, FortiSandbox 3.1 all versions, FortiSandbox 3.0.5 through 3.0.7 allows an authenticated attacker with at least read-only permission to execute unauthorized commands via crafted requests.

8.8 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://fortiguard.fortinet.com/psirt/FG-IR-24-061 Vendor Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:fortinet:fortisandbox:*:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortisandbox:*:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortisandbox:*:*:*:*:*:*:*:*
History

14 Jan 2026, 15:15

Type Values Removed Values Added
Summary (en) An improper neutralization of special elements used in an OS Command vulnerability [CWE-78] in Fortinet FortiSandbox version 4.4.0 through 4.4.4, 4.2.0 through 4.2.6 and below 4.0.4 allows an authenticated attacker with at least read-only permission to execute unauthorized commands via crafted requests. (en) An improper neutralization of special elements used in an OS Command vulnerability [CWE-78] vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.4, FortiSandbox 4.2.1 through 4.2.6, FortiSandbox 4.0.0 through 4.0.4, FortiSandbox 3.2 all versions, FortiSandbox 3.1 all versions, FortiSandbox 3.0.5 through 3.0.7 allows an authenticated attacker with at least read-only permission to execute unauthorized commands via crafted requests.

31 Jan 2025, 17:35

Type Values Removed Values Added
CPE cpe:2.3:a:fortinet:fortisandbox:*:*:*:*:*:*:*:*
First Time Fortinet
Fortinet fortisandbox
Summary
  • (es) Una neutralización incorrecta de elementos especiales utilizados en una vulnerabilidad de comando del sistema operativo [CWE-78] en Fortinet FortiSandbox versión 4.4.0 a 4.4.4, 4.2.0 a 4.2.6 y anteriores a 4.0.4 permite que un atacante autenticado con al menos permiso de solo lectura ejecute comandos no autorizados a través de solicitudes manipuladas.
References () https://fortiguard.fortinet.com/psirt/FG-IR-24-061 - () https://fortiguard.fortinet.com/psirt/FG-IR-24-061 - Vendor Advisory

14 Jan 2025, 14:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-01-14 14:15

Updated : 2026-01-14 15:15

NVD link : CVE-2024-27778

Mitre link : CVE-2024-27778

CVE.ORG link : CVE-2024-27778

JSON object : View

Products Affected

fortinet

  • fortisandbox
CWE
CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')