CVE-2023-47540

MEDIUM

FortiSandbox 3.0.5-3.0.7, 4.0, 4.2.1-4.2.6, 4.4.0-4.4.2 - OS Command Injection via CLI

Title source: llm
STIX 2.1

Description

An improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.2, FortiSandbox 4.2.1 through 4.2.6, FortiSandbox 4.0 all versions, FortiSandbox 3.2 all versions, FortiSandbox 3.0.5 through 3.0.7 allows attacker to execute unauthorized code or commands via CLI.

References (1)

Core 1
Core References

Scores

CVSS v3 6.7
EPSS 0.0014
EPSS Percentile 33.2%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact total

Details

CWE
CWE-78
Status published
Products (1)
fortinet/fortisandbox 3.0.5 - 3.0.7
Published Apr 09, 2024
Tracked Since Feb 18, 2026