CVE-2024-48889

State: Published
Severity: 7.2 High
Published: Dec 18, 2024
Updated: Aug 27, 2025
Reserved: Oct 9, 2024

Description

An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability [CWE-78] in FortiManager version 7.6.0, version 7.4.4 and below, version 7.2.7 and below, version 7.0.12 and below, version 6.4.14 and below and FortiManager Cloud version 7.4.4 and below, version 7.2.7 to 7.2.1, version 7.0.12 to 7.0.1 may allow an authenticated remote attacker to execute unauthorized code via FGFM crafted requests.

Scores

CVSS	Score	Vector	Source
3.1	7.2 High	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:H/RL:U/RC:X	fortinet

Weaknesses

CWE-78 Execute unauthorized code or commands

Affected Products

Product	Versions
FortiManagerFortinet	7.6.0Affected 7.4.0 through 7.4.4Affected 7.2.3 through 7.2.7Affected 7.0.5 through 7.0.12Affected 6.4.10 through 6.4.14Affected

References

https://fortiguard.fortinet.com/psirt/FG-IR-24-425

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.