← Back

CVE-2026-25690

nvd nist
Published: May 12, 2026Modified: Jun 17, 2026

JSON object

Loading...
6.5
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Exploitability: 2.8 / Impact: 3.6
Source: NVD

Description

An improper neutralization of argument delimiters in a command ('argument injection') vulnerability in Fortinet FortiDeceptor 6.0.0 through 6.0.2, FortiDeceptor 5.3.0 through 5.3.3, FortiDeceptor 5.2.0 through 5.2.1, FortiDeceptor 5.1 all versions, FortiDeceptor 5.0 all versions may allow an authenticated attacker with at least read-only admin permission to read log files via HTTP crafted requests.

Affected (5)

Fortinet
1 product
Fortideceptor
Configuration A
5 vulnerable
Vulnerable SoftwareAffected Versions
Fortinet
Fortideceptor
From 5.0.0 to 5.1.0
Fortideceptor
From 5.3.0 to 5.3.3
Fortideceptor
From 6.0.0 to 6.0.2
Fortideceptor
Version 5.2.0
Fortideceptor
Version 5.2.1

Related CWEs

CWE-88
Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')
The product constructs a string for a command to be executed by a separate component in another control sphere, but it does not properly delimit the intended arguments, options, or switches within that command string.

References (1)

Source: psirt@fortinet.com
Vendor Advisory

Timeline

No history available yet.