Relative path traversal vulnerability in CLI

Summary

A path traversal vulnerability [CWE-22] in FortiAP-U CLI may allow an admin user to delete and access unauthorized files and data via specifically crafted CLI commands.

Affected Products

FortiAP-U version 6.2.0 through 6.2.3
FortiAP-U 6.0 all versions
FortiAP-U 5.4 all versions

Solutions

Please upgrade to FortiAP-U 6.2.4 or above.

Acknowledgement

Internally discovered and reported by Wilfried Djettchou of Fortinet Product Security team.