CVE-2023-36634

Published: Sep 13, 2023Modified: Jun 17, 2026

8.8

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 2.8 / Impact: 5.9

Source: NVD

Description

An incomplete filtering of one or more instances of special elements vulnerability [CWE-792] in the command line interpreter of FortiAP-U 7.0.0, 6.2.0 through 6.2.5, 6.0 all versions, 5.4 all versions may allow an authenticated attacker to list and delete arbitrary files and directory via specially crafted command arguments.

Affected (4)

Products: Fortinet: Fortiap U

1 product

Configuration A

4 vulnerable

Vulnerable Software	Affected Versions
Fortinet Fortiap U	From 5.4.0 to 5.4.6
Fortinet Fortiap U	From 6.0.0 to 6.0.4
Fortinet Fortiap U	From 6.2.0 to 6.2.5
Fortinet Fortiap U	Version 7.0.0

Related CWEs

External Control of File Name or Path

The product allows user input to control or influence paths or file names that are used in filesystem operations.

References (2)

https://fortiguard.com/psirt/FG-IR-23-123

Source: psirt@fortinet.com

Vendor Advisory

https://fortiguard.com/psirt/FG-IR-23-123

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.