RCE in Fortinet Fortiap
CVE-2019-15708
A system command injection vulnerability in the FortiAP-S/W2 6.2.1, 6.2.0, 6.0.5 and below, FortiAP 6.0.5 and below and FortiAP-U below 6.0.0 under CLI admin console may allow unauthorized administrators to run arbitrary system level commands via specially crafted ifconfig commands.
Vulnerability class: Command Injection (OS Command Injection)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 6.7 (Medium). Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.006 (48.9th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 49th percentile — 48.9% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.006 · newest: 0.006 · change: 0.000
Affected products
- Fortinet Fortiap
- Fortinet Fortiap-S — versions 6.2.0, 6.2.1
- Fortinet Fortiap-U
- Fortinet Fortiap-W2 — versions 6.2.0, 6.2.1
- Fortinet Fortiap — versions below 6.0.0
- Fortinet Fortiap-S/w2 — versions 6.2.1, 6.2.0, 6.0.5 and below
- Fortinet Fortiap-U — versions 6.0.5 and below
Weakness classification (CWE)
References
- fortiguard.com/psirt/FG-IR-19-209 (Vendor Advisory)
Frequently asked questions
- What is CVE-2019-15708?
- CVE-2019-15708 is a medium-severity vulnerability in Fortinet Fortiap, classified under OS Command Injection. CVSS score: 6.7/10. Published 2020-03-15.
- How severe is CVE-2019-15708?
- Medium severity. CVSS v3 base score is 6.7 out of 10.