An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability [CWE-78]…
Fortinet · FortiSIEM
An OS command injection flaw (CWE-78) in the CLI of Fortinet FortiSIEM, affecting many release lines from 4.7 through 7.3.1. An unauthenticated attacker can execute unauthorized code or commands by sending crafted CLI requests, with no user interaction required and no prior authentication needed over the network.
An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability [CWE-78] vulnerability in Fortinet FortiSIEM 7.3.0 through 7.3.1, FortiSIEM 7.2.0 through 7.2.5, FortiSIEM 7.1.0 through 7.1.7, FortiSIEM 7.0.0 through 7.0.3, FortiSIEM 6.7.0 through 6.7.9, FortiSIEM 6.6 all versions, FortiSIEM 6.5 all versions, FortiSIEM 6.4 all versions, FortiSIEM 6.3 all versions, FortiSIEM 6.2 all versions, FortiSIEM 6.1 all versions, FortiSIEM 5.4 all versions, FortiSIEM 5.3 all versions, FortiSIEM 5.2 all versions, FortiSIEM 5.1 all versions, FortiSIEM 5.0 all versions, FortiSIEM 4.10 all versions, FortiSIEM 4.9 all versions, FortiSIEM 4.7 all versions allows an unauthenticated attacker to execute unauthorized code or commands via crafted CLI requests.
- Exploited
- Yes, in VulnCheck KEV
- Reports
- 0
- Tactics
- 0/15
Exploitation timelineDated milestones for a CVE: when it was disclosed, when exploit code became public, when exploitation was confirmed, and when threat reports named it.
First seen exploited the day it was disclosed. Public exploit code (PoC-in-GitHub) appeared 3 days after disclosure.
- Public exploit codePoC-in-GitHub+3 days
MITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. techniques
No techniques linkedNo ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.
What security researchers reported
Not named in any threat report yetAlso mentioned in 10 community threat pulses (AlienVault OTX)
Weaker evidencePulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.
- August Vulnerabilities of Note17 Sep 2025
- IOC - August Vulnerabilities of Note16 Sep 2025
- August Vulnerabilities of Note15 Sep 2025
- Threat Actors Deploy Sinobi Ransomware via Compromised SonicWall SSL VPN Credentials29 Aug 2025
- IOC - Greedy Sponge Targets Mexico with AllaKore RAT and SystemBC22 Aug 2025
- Greedy Sponge Targets Mexico with AllaKore RAT and SystemBC21 Aug 2025
- 4 more on OTX