FortiADC - command injection in web interface

Summary

An improper neutralization of special elements used in an OS Command vulnerability [CWE-78] in FortiADC may allow an authenticated attacker with access to the web GUI to execute unauthorized code or commands via specifically crafted HTTP requests.

Affected Products

FortiADC version 7.0.0 through 7.0.1
FortiADC version 6.2.0 through 6.2.3
FortiADC version 5.4.0 through 5.4.5
FortiADC all versions 6.1
FortiADC all versions 6.0

Solutions

Please upgrade to FortiADC 7.0.2 or above
Please upgrade to FortiADC 6.2.4 or above
Please upgrade to upcoming FortiADC 5.4.6 or above

Acknowledgement

Internally discovered and reported by Gwendal Guégniaud of Fortinet Product Security Team.