- Description
- An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability [CWE-78] vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.2, FortiSandbox 4.4.0 through 4.4.7, FortiSandbox 4.2 all versions, FortiSandbox 4.0 all versions, FortiSandbox Cloud 24.1, FortiSandbox Cloud 23 all versions allows a remote privileged attacker to execute unauthorized code or commands via crafted HTTP or HTTPS requests.
- Source
- psirt@fortinet.com
- NVD status
- Analyzed
- Products
- fortisandbox, fortisandbox_cloud
CVSS 3.1
- Type
- Secondary
- Base score
- 7.2
- Impact score
- 5.9
- Exploitability score
- 1.2
- Vector string
- CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
- Severity
- HIGH
- psirt@fortinet.com
- CWE-78
- Hype score
- Not currently trending
CVE-2025-53679 An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability [CWE-78] in Fortinet FortiSandbox version 5.0.0 through 5.… https://t.co/QVNjz2fHzx
@CVEnew
10 Dec 2025
137 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
🔵 Fortinet FortiSandbox, #OS Command Injection, #CVE-2025-53679 https://t.co/j9Xw4wz2Ro
@dailycve
10 Dec 2025
14 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
[
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:fortinet:fortisandbox:*:*:*:*:*:*:*:*",
"matchCriteriaId": "C0B145A7-83A1-4ED2-A9DC-109CAB0AB217",
"versionEndExcluding": "4.4.8",
"versionStartIncluding": "4.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:fortinet:fortisandbox:*:*:*:*:*:*:*:*",
"matchCriteriaId": "7A1CEA31-8309-4B13-8A3C-4830394A728D",
"versionEndExcluding": "5.0.3",
"versionStartIncluding": "5.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:fortinet:fortisandbox_cloud:*:*:*:*:*:*:*:*",
"matchCriteriaId": "31574D18-7175-4634-B191-99080F0FAF2F",
"versionEndExcluding": "23.4.4374",
"versionStartIncluding": "23.1.4245",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:fortinet:fortisandbox_cloud:24.1.4436:*:*:*:*:*:*:*",
"matchCriteriaId": "529FB46C-C0E5-43F5-A753-DD9E928FD4E6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
]