CVE-2025-49813

HIGH

FortiADC 7.2.0 and < 7.1.1 - Authenticated OS Command Injection via HTTP Parameters

Title source: llm
STIX 2.1

Description

An improper neutralization of special elements used in an OS Command ("OS Command Injection") vulnerability [CWE-78] in Fortinet FortiADC version 7.2.0 and before 7.1.1 allows a remote and authenticated attacker with low privilege to execute unauthorized code via specifically crafted HTTP parameters.

References (1)

Core 1
Core References

Scores

CVSS v3 7.2
EPSS 0.0024
EPSS Percentile 46.8%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact total

Details

CWE
CWE-78
Status published
Products (2)
fortinet/fortiadc 7.2.0
fortinet/fortiadc 6.2.0 - 6.2.6
Published Aug 12, 2025
Tracked Since Feb 18, 2026