CVE-2023-47540

CVE Database · CVE-2023-47540

CVE-2023-47540

· MEDIUMModified

CVSS v3.1

6.7

EPSS

0.63%

Published

Apr 9, 2024

Modified

Jan 14, 2026

Public PoC / Exploit

All weaponized →

No public PoC or exploit code indexed for this CVE.

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

An improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.2, FortiSandbox 4.2.1 through 4.2.6, FortiSandbox 4.0 all versions, FortiSandbox 3.2 all versions, FortiSandbox 3.0.5 through 3.0.7 allows attacker to execute unauthorized code or commands via CLI.

CVSS Vector

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

CWE-78

Affected Products (3)

fortinet · fortisandboxvulnerable

fortinet · fortisandbox (up to 4.2.7)vulnerable

fortinet · fortisandbox (up to 4.4.3)vulnerable

References (2)

https://fortiguard.com/psirt/FG-IR-23-411

Vendor Advisory

https://fortiguard.com/psirt/FG-IR-23-411

Vendor Advisory

KEV Catalog EPSS Scores Vendors All CVEs