CVE-2023-34993

Deeper analysis

CVE-2023-34993 is an OS command injection vulnerability (CWE-78) affecting Fortinet FortiWLM wireless LAN management software in versions 8.6.0 through 8.6.5 and 8.5.0 through 8.5.4. The flaw stems from improper neutralization of special elements in OS commands, enabling remote attackers to inject and execute arbitrary commands through crafted parameters in HTTP GET requests. It carries a CVSS 3.1 base score of 9.8, reflecting network-accessible exploitation with no required authentication or user interaction and full impact on confidentiality, integrity, and availability.

An unauthenticated attacker can send a maliciously constructed HTTP GET request to an exposed FortiWLM instance and achieve arbitrary code execution on the underlying system. This grants the ability to run unauthorized commands, potentially leading to full device compromise, data exfiltration, or use as a foothold for further network attacks.

The vendor advisory FG-IR-23-140, published alongside the CVE, directs administrators to apply the fixes released by Fortinet for the affected FortiWLM branches.

The EPSS score for this vulnerability currently stands at 0.8768 with a recorded peak of 0.9683, indicating sustained high exploitation interest following disclosure.