4.0
Medium
CVE-2026-25690 An improper neutralization of argument delimiters in a command ('argument injection') vulnerability in Fortinet…
Description
An improper neutralization of argument delimiters in a command ('argument injection') vulnerability in Fortinet FortiDeceptor 6.0.0 through 6.0.2, FortiDeceptor 5.3.0 through 5.3.3, FortiDeceptor 5.2.0 through 5.2.1, FortiDeceptor 5.1 all versions, FortiDeceptor 5.0 all versions may allow an authenticated attacker with at least read-only admin permission to read log files via HTTP crafted requests.
CVSS 3.1 detail
Vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:F/RL:O/RC:CExploitable remotely over the network, with an ordinary account and without any user action; the impact on data or service is limited.
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- Low
- Interaction
- None
- Scope
- Unchanged
- Confidentiality
- Low
- Integrity
- None
- Availability
- None
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| FortiDeceptor 6.0 | 6.0.0 → 6.0.2 | No fix stated |
| FortiDeceptor 5.3 | 5.3.0 → 5.3.3 | No fix stated |
| FortiDeceptor 5.2 | 5.2.0 → 5.2.1 | No fix stated |
| FortiDeceptor | 5.1.0 | No fix stated |
| FortiDeceptor | 5.0.0 | No fix stated |
Other CVEs of FortiDeceptor
The 7 CVEs of FortiDeceptor →
CVE-2026-25689
An improper neutralization of argument delimiters in a command ('argument injection') vulnerability in Fortinet…
6.0
Medium
CVE-2024-35280
A improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Fortinet…
5.1
Medium
CVE-2024-45326
An Improper Access Control vulnerability [CWE-284] vulnerability in Fortinet FortiDeceptor 6.0.0, FortiDeceptor 5.3…
3.9
Low
CVE-2022-27487
A improper privilege management in Fortinet FortiSandbox version 4.2.0 through 4.2.2, 4.0.0 through 4.0.2 and before…
8.3
High