CVE-2022-39947
Published: 03 January 2023
Summary
CVE-2022-39947 is a high-severity OS Command Injection (CWE-78) vulnerability in Fortinet Fortiadc. Its CVSS base score is 8.8 (High).
Operationally, ranked in the top 9.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
The vulnerability is an OS command injection flaw, tracked as CWE-78, that affects multiple versions of Fortinet FortiADC including 7.0.0 through 7.0.2, 6.2.0 through 6.2.3, 6.1.0 through 6.1.6, 6.0.0 through 6.0.4, and 5.4.0 through 5.4.5. It stems from improper neutralization of special elements in OS commands and carries a CVSS 3.1 score of 8.8.
An authenticated attacker with low privileges can exploit the issue over the network by sending specifically crafted HTTP requests, resulting in execution of unauthorized code or commands with full impact to confidentiality, integrity, and availability.
The official Fortinet advisory FG-IR-22-061 at https://fortiguard.com/psirt/FG-IR-22-061 provides mitigation guidance and patch information for affected FortiADC deployments. The EPSS score has remained flat at 0.0522 with no material increase since disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-42391
Vulnerability details
A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiADC version 7.0.0 through 7.0.2, FortiADC version 6.2.0 through 6.2.3, FortiADC version version 6.1.0 through 6.1.6, FortiADC version 6.0.0 through 6.0.4, FortiADC version 5.4.0…
more
through 5.4.5 may allow an attacker to execute unauthorized code or commands via specifically crafted HTTP requests.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.