Command injection in Automation/Webhook module

Summary

An improper neutralization of special elements used in an OS command vulnerability [CWE-78] in the management interface of FortiADC may allow an authenticated attacker to execute unauthorized commands via specifically crafted arguments to existing commands.

Affected Products

FortiADC 7.4 all versions are not affected
FortiADC 7.2 all versions are not affected
FortiADC version 7.1.0 through 7.1.1
FortiADC version 7.0.0 through 7.0.3
FortiADC version 6.2.0 through 6.2.5
FortiADC 6.1 all versions
FortiADC 6.0 all versions are not affected
FortiADC 5.4 all versions are not affected
FortiADC 5.3 all versions are not affected

Solutions

Please upgrade to FortiADC version 7.1.2 or above
Please upgrade to FortiADC version 7.0.4 or above
Please upgrade to FortiADC version 6.2.6 or above

Timeline

2023-09-13: Initial publication