Fortinet FortiVoice OS Command Injection Vulnerability Allowing Arbitrary Code Execution

A vulnerability allowing OS command injection has been identified in Fortinet FortiVoice versions 7.2.0, 7.0.0 through 7.0.6, and prior to 6.4.10. This vulnerability arises from improper neutralization of special elements used in OS commands, and it allows a privileged attacker to execute arbitrary code or commands. The exploitation can be carried out via crafted HTTP, HTTPS, or CLI requests.

Impact

Exploitation of this vulnerability allows for unauthorized execution of code or commands on the affected system.

Remediation

Users can upgrade to Fortinet FortiVoice 7.2.1 or above, 7.0.7 or above, or 6.4.11 or above, depending on their current version.