Sign-up

ID

VAR-202512-0955


CVE

CVE-2025-53949


TITLE

Fortinet FortiSandbox name Parameter Command Injection Remote Code Execution Vulnerability

Trust: 0.7

sources: ZDI: ZDI-25-1097

DESCRIPTION

An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability [CWE-78] vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.2, FortiSandbox 4.4.0 through 4.4.7, FortiSandbox 4.2 all versions, FortiSandbox 4.0 all versions may allow an authenticated attacker to execute unauthorized code on the underlying system via crafted HTTP requests. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Fortinet FortiSandbox. Authentication is required to exploit this vulnerability.The specific flaw exists within the handling of the names parameter provided to the admindel_confirm endpoint. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root

Trust: 2.79

sources: NVD: CVE-2025-53949 // ZDI: ZDI-25-1097 // ZDI: ZDI-25-1096 // ZDI: ZDI-25-1095

AFFECTED PRODUCTS

vendor:fortinetmodel:fortisandboxscope: - version: -

Trust: 2.1

vendor:fortinetmodel:fortisandboxscope:gteversion:4.0.0

Trust: 1.0

vendor:fortinetmodel:fortisandboxscope:lteversion:4.4.7

Trust: 1.0

vendor:fortinetmodel:fortisandboxscope:lteversion:4.2.8

Trust: 1.0

vendor:fortinetmodel:fortisandboxscope:lteversion:5.0.2

Trust: 1.0

vendor:fortinetmodel:fortisandboxscope:gteversion:5.0.0

Trust: 1.0

vendor:fortinetmodel:fortisandboxscope:gteversion:4.4.0

Trust: 1.0

vendor:fortinetmodel:fortisandboxscope:lteversion:4.0.6

Trust: 1.0

vendor:fortinetmodel:fortisandboxscope:gteversion:4.2.0

Trust: 1.0

sources: ZDI: ZDI-25-1097 // ZDI: ZDI-25-1096 // ZDI: ZDI-25-1095 // NVD: CVE-2025-53949

CVSS

SEVERITY

CVSSV2

CVSSV3

ZDI: CVE-2025-53949
value: HIGH

Trust: 2.1

psirt@fortinet.com: CVE-2025-53949
value: HIGH

Trust: 1.0

nvd@nist.gov: CVE-2025-53949
value: HIGH

Trust: 1.0

ZDI: CVE-2025-53949
baseSeverity: HIGH
baseScore: 8.8
vectorString: AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 2.8
impactScore: 5.9
version: 3.0

Trust: 2.1

psirt@fortinet.com: CVE-2025-53949
baseSeverity: HIGH
baseScore: 7.2
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: HIGH
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 1.2
impactScore: 5.9
version: 3.1

Trust: 1.0

nvd@nist.gov: CVE-2025-53949
baseSeverity: HIGH
baseScore: 8.8
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 2.8
impactScore: 5.9
version: 3.1

Trust: 1.0

sources: ZDI: ZDI-25-1097 // ZDI: ZDI-25-1096 // ZDI: ZDI-25-1095 // NVD: CVE-2025-53949 // NVD: CVE-2025-53949

PROBLEMTYPE DATA

problemtype:CWE-78

Trust: 1.0

sources: NVD: CVE-2025-53949

PATCH

title:Fortinet has issued an update to correct this vulnerability.url:https://fortiguard.fortinet.com/psirt/FG-IR-25-479

Trust: 2.1

sources: ZDI: ZDI-25-1097 // ZDI: ZDI-25-1096 // ZDI: ZDI-25-1095

EXTERNAL IDS

db:NVDid:CVE-2025-53949

Trust: 3.1

db:ZDI_CANid:ZDI-CAN-27309

Trust: 0.7

db:ZDIid:ZDI-25-1097

Trust: 0.7

db:ZDI_CANid:ZDI-CAN-27308

Trust: 0.7

db:ZDIid:ZDI-25-1096

Trust: 0.7

db:ZDI_CANid:ZDI-CAN-27305

Trust: 0.7

db:ZDIid:ZDI-25-1095

Trust: 0.7

sources: ZDI: ZDI-25-1097 // ZDI: ZDI-25-1096 // ZDI: ZDI-25-1095 // NVD: CVE-2025-53949

REFERENCES

url:https://fortiguard.fortinet.com/psirt/fg-ir-25-479

Trust: 3.1

sources: ZDI: ZDI-25-1097 // ZDI: ZDI-25-1096 // ZDI: ZDI-25-1095 // NVD: CVE-2025-53949

CREDITS

Jason McFadyen of Trend Research

Trust: 2.1

sources: ZDI: ZDI-25-1097 // ZDI: ZDI-25-1096 // ZDI: ZDI-25-1095

SOURCES

db:ZDIid:ZDI-25-1097
db:ZDIid:ZDI-25-1096
db:ZDIid:ZDI-25-1095
db:NVDid:CVE-2025-53949

LAST UPDATE DATE

2025-12-20T23:46:13.756000+00:00


SOURCES UPDATE DATE

db:ZDIid:ZDI-25-1097date:2025-12-16T00:00:00
db:ZDIid:ZDI-25-1096date:2025-12-16T00:00:00
db:ZDIid:ZDI-25-1095date:2025-12-16T00:00:00
db:NVDid:CVE-2025-53949date:2025-12-09T20:12:27.760

SOURCES RELEASE DATE

db:ZDIid:ZDI-25-1097date:2025-12-16T00:00:00
db:ZDIid:ZDI-25-1096date:2025-12-16T00:00:00
db:ZDIid:ZDI-25-1095date:2025-12-16T00:00:00
db:NVDid:CVE-2025-53949date:2025-12-09T18:15:53.640