RCE in Fortinet Fortiap
CVE-2019-15708
A system command injection vulnerability in the FortiAP-S/W2 6.2.1, 6.2.0, 6.0.5 and below, FortiAP 6.0.5 and below and FortiAP-U below 6.0.0 under CLI admin console may allow unauthorized administrators to run arbitrary system level comma…
Vulnerability class: Command Injection (OS Command Injection)
EPSS: 0.006 (46.0th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 6.7 (Medium). Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Fortinet Fortiap
- Fortinet Fortiap-s — versions 6.2.0, 6.2.1
- Fortinet Fortiap-u
- Fortinet Fortiap-w2 — versions 6.2.0, 6.2.1
- Fortinet Fortiap — versions below 6.0.0
- Fortinet Fortiap-s/w2 — versions 6.2.1, 6.2.0, 6.0.5 and below
- Fortinet Fortiap-u — versions 6.0.5 and below
Weakness classification (CWE)
References
- psirt@fortinet.com (x_refsource_CONFIRM, Vendor Advisory)
Frequently asked questions
- What is CVE-2019-15708?
- CVE-2019-15708 is a medium-severity vulnerability in Fortinet Fortiap, classified under OS Command Injection. CVSS score: 6.7/10. Published 2020-03-15.
- How severe is CVE-2019-15708?
- Medium severity. CVSS v3 base score is 6.7 out of 10.