7.0
High
CVE-2022-27489 A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiExtender…
Description
A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiExtender 7.0.0 through 7.0.3, 5.3.2, 4.2.4 and below allows attacker to execute unauthorized code or commands via crafted HTTP requests.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| FortiExtender 7.0 | 7.0.0 → 7.0.3 | No fix stated |
| FortiExtender | 5.3.2 | No fix stated |
| FortiExtender 4.2 | 4.2.0 → 4.2.4 | No fix stated |
| FortiExtender 4.1 | 4.1.1 → 4.1.8 | No fix stated |
| FortiExtender 4.0 | 4.0.0 → 4.0.2 | No fix stated |
| FortiExtender 3.3 | 3.3.0 → 3.3.2 | No fix stated |
| FortiExtender 3.2 | 3.2.1 → 3.2.3 | No fix stated |
| FortiExtender 3.1 | 3.1.0 → 3.1.2 | No fix stated |
| FortiExtender 3.0 | 3.0.0 → 3.0.2 | No fix stated |
References
- fortiguard.com fortiguard.com
Timeline
- Published
- Last modified
Other CVEs of FortiExtender
The 7 CVEs of FortiExtender →
CVE-2025-64153
A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiExtender…
6.7
Medium
CVE-2025-46775
A debug messages revealing unnecessary information vulnerability in Fortinet FortiExtender 7.6.0 through 7.6.1,…
5.2
Medium
CVE-2025-46776
A buffer copy without checking size of input ('classic buffer overflow') vulnerability in Fortinet FortiExtender 7.6.0…
6.3
Medium
CVE-2024-23663
An improper access control in Fortinet FortiExtender 4.1.1 - 4.1.9, 4.2.0 - 4.2.6, 5.3.2, 7.0.0 - 7.0.4, 7.2.0 - 7.2.4…
8.1
High