CVE-2023-28000

Name of the Vulnerable Software and Affected Versions FortiADC versions 6.0 through 7.1.0

Description The issue is related to an improper neutralization of special elements used in an OS command, which may allow a local and authenticated attacker to execute unauthorized commands via specifically crafted arguments in the diagnose system df CLI command. This could enable an attacker to perform arbitrary command execution.

Recommendations For FortiADC versions 6.0 through 7.1.0, consider restricting access to the diagnose system df CLI command until a patch is available. As a temporary workaround, avoid using specifically crafted arguments in this command to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.