Security Experts:

Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

Vulnerabilities

High-Severity Command Injection Flaws Found in Fortinet’s FortiTester, FortiADC

Cybersecurity solutions provider Fortinet this week announced patches for several vulnerabilities across its product portfolio and informed customers about a high-severity command injection bug in FortiADC.

Cybersecurity solutions provider Fortinet this week announced patches for several vulnerabilities across its product portfolio and informed customers about a high-severity command injection bug in FortiADC.

Tracked as CVE-2022-39947 (CVSS score of 8.6), the security defect was identified in the FortiADC web interface and could lead to arbitrary code execution.

“An improper neutralization of special elements used in an OS command vulnerability in FortiADC may allow an authenticated attacker with access to the web GUI to execute unauthorized code or commands via specifically crafted HTTP requests,” Fortinet explains.

The issue impacts FortiADC versions 5.4.x, 6.0.x, 6.1.x, 6.2.x, and 7.0.x, and will be addressed with the release of FortiADC 6.2.4 and 7.0.2, Fortinet notes in its advisory.

On Tuesday, the company also announced patches for multiple high-severity command injection flaws in FortiTester.

Collectively tracked as CVE-2022-35845 (CVSS score of 7.6), the bugs are described as an improper neutralization of special elements that could lead to arbitrary command execution in the underlying shell. Authentication is required to exploit this vulnerability.

According to Fortinet, the issue impacts FortiTester versions 2.x.x, 3.x.x, 4.x.x, 7.x, and 7.1.0, and was addressed with the release of FortiTester versions 3.9.2, 4.2.1, 7.1.1, and 7.2.0.

Three other vulnerabilities that Fortinet addressed this week have a severity rating of ‘medium’ and are described as an incorrect user management issue in FortiManager leading to passwordless admin in FortiGate, an improper neutralization of input bug in FortiPortal leading to cross-site scripting (XSS), and an improper neutralization of CRLF sequences flaw in FortiWeb leading to arbitrary header injection.

The company makes no mention of any of these vulnerabilities being exploited in attacks. Additional information on the security flaws can be found on Fortinet’s PSIRT page.

Related: Fortinet Patches High-Severity Authentication Bypass Vulnerability in FortiOS

Related: Fortinet Admits Many Devices Still Unprotected Against Exploited Vulnerability

Related: Fortinet Patches 6 High-Severity Vulnerabilities

Written By

Ionut Arghire is an international correspondent for SecurityWeek.

Click to comment

Expert Insights

Related Content

Cloud Security

VMware vRealize Log Insight vulnerability allows an unauthenticated attacker to take full control of a target system.

IoT Security

Lexmark warns of a remote code execution (RCE) vulnerability impacting over 120 printer models, for which PoC code has been published.

Mobile & Wireless

Apple rolled out iOS 16.3 and macOS Ventura 13.2 to cover serious security vulnerabilities.

Email Security

Microsoft is urging customers to install the latest Exchange Server updates and harden their environments to prevent malicious attacks.

Mobile & Wireless

Technical details published for an Arm Mali GPU flaw leading to arbitrary kernel code execution and root on Pixel 6.

Application Security

Drupal released updates that resolve four vulnerabilities in Drupal core and three plugins.

Vulnerabilities

Security researchers have observed an uptick in attacks targeting CVE-2021-35394, an RCE vulnerability in Realtek Jungle SDK.

Vulnerabilities

Google has awarded more than $25,000 to the researchers who reported the vulnerabilities patched with the release of the latest Chrome update.