CVE-2024-52961

HIGH

FortiSandbox 3.0.0-4.0.5, 4.2.1-4.2.7, 4.4.0-4.4.6, 5.0.0 - Authenticated OS Command Injection

Title source: llm
STIX 2.1

Description

An improper neutralization of special elements used in an OS Command vulnerability [CWE-78] vulnerability in Fortinet FortiSandbox 5.0.0, FortiSandbox 4.4.0 through 4.4.6, FortiSandbox 4.2.1 through 4.2.7, FortiSandbox 4.0.0 through 4.0.5, FortiSandbox 3.2 all versions, FortiSandbox 3.1 all versions, FortiSandbox 3.0 all versions allows an authenticated attacker with at least read-only permission to execute unauthorized commands via crafted requests.

References (1)

Core 1
Core References

Scores

CVSS v3 8.8
EPSS 0.0040
EPSS Percentile 61.0%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact total

Details

CWE
CWE-78
Status published
Products (2)
fortinet/fortisandbox 5.0.0
fortinet/fortisandbox 3.0.0 - 4.0.6
Published Mar 11, 2025
Tracked Since Feb 18, 2026