{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-26210", "assignerOrgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", "state": "PUBLISHED", "assignerShortName": "fortinet", "dateReserved": "2023-02-20T15:09:20.637Z", "datePublished": "2023-06-13T08:41:46.873Z", "dateUpdated": "2024-10-23T14:26:13.951Z"}, "containers": {"cna": {"affected": [{"vendor": "Fortinet", "product": "FortiADCManager", "defaultStatus": "unaffected", "versions": [{"version": "7.1.0", "status": "affected"}, {"version": "7.0.0", "status": "affected"}, {"versionType": "semver", "version": "6.2.0", "lessThanOrEqual": "6.2.1", "status": "affected"}, {"version": "6.1.0", "status": "affected"}, {"version": "6.0.0", "status": "affected"}, {"version": "5.4.0", "status": "affected"}, {"version": "5.3.0", "status": "affected"}, {"versionType": "semver", "version": "5.2.0", "lessThanOrEqual": "5.2.1", "status": "affected"}]}, {"vendor": "Fortinet", "product": "FortiADC", "defaultStatus": "unaffected", "versions": [{"version": "7.2.0", "status": "affected"}, {"versionType": "semver", "version": "7.1.0", "lessThanOrEqual": "7.1.1", "status": "affected"}, {"versionType": "semver", "version": "7.0.0", "lessThanOrEqual": "7.0.5", "status": "affected"}, {"versionType": "semver", "version": "6.2.0", "lessThanOrEqual": "6.2.6", "status": "affected"}, {"versionType": "semver", "version": "6.1.0", "lessThanOrEqual": "6.1.6", "status": "affected"}, {"versionType": "semver", "version": "6.0.0", "lessThanOrEqual": "6.0.4", "status": "affected"}, {"versionType": "semver", "version": "5.4.0", "lessThanOrEqual": "5.4.5", "status": "affected"}, {"versionType": "semver", "version": "5.3.0", "lessThanOrEqual": "5.3.7", "status": "affected"}, {"versionType": "semver", "version": "5.2.0", "lessThanOrEqual": "5.2.8", "status": "affected"}]}], "descriptions": [{"lang": "en", "value": "Multiple improper neutralization of special elements used in an os command ('OS Command Injection') vulnerabilties [CWE-78] in Fortinet FortiADCManager version 7.1.0 and before 7.0.0, FortiADC version 7.2.0 and before 7.1.2 allows a local authenticated attacker to execute arbitrary shell code as `root` user via crafted CLI requests."}], "providerMetadata": {"orgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", "shortName": "fortinet", "dateUpdated": "2023-06-13T08:41:46.873Z"}, "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-78", "description": "Execute unauthorized code or commands", "type": "CWE"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"version": "3.1", "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:X/RL:X/RC:C"}}], "solutions": [{"lang": "en", "value": "Please upgrade to FortiADC version 7.2.1 or above\r\nPlease upgrade to FortiADC version 7.1.3 or above\r\nPlease upgrade to FortiADCManager version 7.2.0 or above\r\nPlease upgrade to FortiADCManager version 7.1.1 or above\r\nPlease upgrade to FortiADCManager version 7.0.1 or above"}], "references": [{"name": "https://fortiguard.com/psirt/FG-IR-23-076", "url": "https://fortiguard.com/psirt/FG-IR-23-076"}]}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T11:46:23.415Z"}, "title": "CVE Program Container", "references": [{"name": "https://fortiguard.com/psirt/FG-IR-23-076", "url": "https://fortiguard.com/psirt/FG-IR-23-076", "tags": ["x_transferred"]}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-10-23T14:10:55.831517Z", "id": "CVE-2023-26210", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-10-23T14:26:13.951Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://fortiguard.com/psirt/FG-IR-23-076", "name": "https://fortiguard.com/psirt/FG-IR-23-076", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T11:46:23.415Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-26210", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-10-23T14:10:55.831517Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-10-23T14:14:38.085Z"}}], "cna": {"metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:X/RL:X/RC:C", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "Fortinet", "product": "FortiADCManager", "versions": [{"status": "affected", "version": "7.1.0"}, {"status": "affected", "version": "7.0.0"}, {"status": "affected", "version": "6.2.0", "versionType": "semver", "lessThanOrEqual": "6.2.1"}, {"status": "affected", "version": "6.1.0"}, {"status": "affected", "version": "6.0.0"}, {"status": "affected", "version": "5.4.0"}, {"status": "affected", "version": "5.3.0"}, {"status": "affected", "version": "5.2.0", "versionType": "semver", "lessThanOrEqual": "5.2.1"}], "defaultStatus": "unaffected"}, {"vendor": "Fortinet", "product": "FortiADC", "versions": [{"status": "affected", "version": "7.2.0"}, {"status": "affected", "version": "7.1.0", "versionType": "semver", "lessThanOrEqual": "7.1.1"}, {"status": "affected", "version": "7.0.0", "versionType": "semver", "lessThanOrEqual": "7.0.5"}, {"status": "affected", "version": "6.2.0", "versionType": "semver", "lessThanOrEqual": "6.2.6"}, {"status": "affected", "version": "6.1.0", "versionType": "semver", "lessThanOrEqual": "6.1.6"}, {"status": "affected", "version": "6.0.0", "versionType": "semver", "lessThanOrEqual": "6.0.4"}, {"status": "affected", "version": "5.4.0", "versionType": "semver", "lessThanOrEqual": "5.4.5"}, {"status": "affected", "version": "5.3.0", "versionType": "semver", "lessThanOrEqual": "5.3.7"}, {"status": "affected", "version": "5.2.0", "versionType": "semver", "lessThanOrEqual": "5.2.8"}], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "Please upgrade to FortiADC version 7.2.1 or above\r\nPlease upgrade to FortiADC version 7.1.3 or above\r\nPlease upgrade to FortiADCManager version 7.2.0 or above\r\nPlease upgrade to FortiADCManager version 7.1.1 or above\r\nPlease upgrade to FortiADCManager version 7.0.1 or above"}], "references": [{"url": "https://fortiguard.com/psirt/FG-IR-23-076", "name": "https://fortiguard.com/psirt/FG-IR-23-076"}], "descriptions": [{"lang": "en", "value": "Multiple improper neutralization of special elements used in an os command ('OS Command Injection') vulnerabilties [CWE-78] in Fortinet FortiADCManager version 7.1.0 and before 7.0.0, FortiADC version 7.2.0 and before 7.1.2 allows a local authenticated attacker to execute arbitrary shell code as `root` user via crafted CLI requests."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-78", "description": "Execute unauthorized code or commands"}]}], "providerMetadata": {"orgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", "shortName": "fortinet", "dateUpdated": "2023-06-13T08:41:46.873Z"}}}, "cveMetadata": {"cveId": "CVE-2023-26210", "state": "PUBLISHED", "dateUpdated": "2024-10-23T14:26:13.951Z", "dateReserved": "2023-02-20T15:09:20.637Z", "assignerOrgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", "datePublished": "2023-06-13T08:41:46.873Z", "assignerShortName": "fortinet"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:fortinet:fortiadc:*:*:*:*:*:*:*:*", "matchCriteriaId": "6B546C4E-F9AF-4514-B5A9-BD29A1FE663E", "versionEndIncluding": "5.2.8", "versionStartIncluding": "5.2.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:fortinet:fortiadc:*:*:*:*:*:*:*:*", "matchCriteriaId": "A3EEDDB2-61AC-43F4-9719-3548057EF30E", "versionEndIncluding": "5.3.7", "versionStartIncluding": "5.3.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:fortinet:fortiadc:*:*:*:*:*:*:*:*", "matchCriteriaId": "54EBC78D-0358-474F-9654-3EF9950D563B", "versionEndIncluding": "5.4.5", "versionStartIncluding": "5.4.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:fortinet:fortiadc:*:*:*:*:*:*:*:*", "matchCriteriaId": "3ADB57D8-1ABE-4401-B1B0-4640A34C555A", "versionEndIncluding": "6.0.4", "versionStartIncluding": "6.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:fortinet:fortiadc:*:*:*:*:*:*:*:*", "matchCriteriaId": "D31CF79E-6C56-4CD0-9DD2-FBB48D503786", "versionEndIncluding": "6.1.6", "versionStartIncluding": "6.1.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:fortinet:fortiadc:*:*:*:*:*:*:*:*", "matchCriteriaId": "F5275C5C-B6FD-4456-B143-ECDD282150C4", "versionEndIncluding": "6.2.6", "versionStartIncluding": "6.2.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:fortinet:fortiadc:*:*:*:*:*:*:*:*", "matchCriteriaId": "302D8FF0-69B6-451A-9B5B-E28B2FAA30D8", "versionEndIncluding": "7.0.5", "versionStartIncluding": "7.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:fortinet:fortiadc:7.1.0:*:*:*:*:*:*:*", "matchCriteriaId": "B35D8D53-448B-474C-B7CB-324CB4ED7A82", "vulnerable": true}, {"criteria": "cpe:2.3:a:fortinet:fortiadc:7.1.1:*:*:*:*:*:*:*", "matchCriteriaId": "933701AE-43E3-4260-973B-4EA09C375965", "vulnerable": true}, {"criteria": "cpe:2.3:a:fortinet:fortiadc:7.1.2:*:*:*:*:*:*:*", "matchCriteriaId": "7F3029D7-4C37-4468-9CCD-45C7259EFF2C", "vulnerable": true}, {"criteria": "cpe:2.3:a:fortinet:fortiadc:7.2.0:*:*:*:*:*:*:*", "matchCriteriaId": "74B0A112-AA30-4D11-8F36-3DC8A2EBCA16", "vulnerable": true}, {"criteria": "cpe:2.3:a:fortinet:fortiadc_manager:5.2.0:*:*:*:*:*:*:*", "matchCriteriaId": "CAA5FB00-FC3E-4777-BD9A-734987027551", "vulnerable": true}, {"criteria": "cpe:2.3:a:fortinet:fortiadc_manager:5.2.1:*:*:*:*:*:*:*", "matchCriteriaId": "9E41C15C-0F00-489B-A613-8ACEB42AB0E0", "vulnerable": true}, {"criteria": "cpe:2.3:a:fortinet:fortiadc_manager:5.3.0:*:*:*:*:*:*:*", "matchCriteriaId": "748AC964-D839-4C52-A66E-0BAA4AE01FF9", "vulnerable": true}, {"criteria": "cpe:2.3:a:fortinet:fortiadc_manager:5.4.0:*:*:*:*:*:*:*", "matchCriteriaId": "FE35CDD0-DFA3-47C9-BC7A-A96DC56104AB", "vulnerable": true}, {"criteria": "cpe:2.3:a:fortinet:fortiadc_manager:6.0.0:*:*:*:*:*:*:*", "matchCriteriaId": "AF5202B6-3CD2-4D7E-8344-6A89B79B2311", "vulnerable": true}, {"criteria": "cpe:2.3:a:fortinet:fortiadc_manager:6.1.0:*:*:*:*:*:*:*", "matchCriteriaId": "F621087C-9173-4CB9-B3CA-303AD0DEBFD0", "vulnerable": true}, {"criteria": "cpe:2.3:a:fortinet:fortiadc_manager:6.2.0:*:*:*:*:*:*:*", "matchCriteriaId": "030BA301-8A64-46AB-990D-24BCDFCDE4E9", "vulnerable": true}, {"criteria": "cpe:2.3:a:fortinet:fortiadc_manager:6.2.1:*:*:*:*:*:*:*", "matchCriteriaId": "692AC209-F327-4746-933B-002601232B42", "vulnerable": true}, {"criteria": "cpe:2.3:a:fortinet:fortiadc_manager:7.0.0:*:*:*:*:*:*:*", "matchCriteriaId": "B4CC6A0A-A3AB-443A-880A-608FC9598D50", "vulnerable": true}, {"criteria": "cpe:2.3:a:fortinet:fortiadc_manager:7.1.0:*:*:*:*:*:*:*", "matchCriteriaId": "9435E543-D4A4-416E-A8A7-CE45868E1F82", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Multiple improper neutralization of special elements used in an os command ('OS Command Injection') vulnerabilties [CWE-78] in Fortinet FortiADCManager version 7.1.0 and before 7.0.0, FortiADC version 7.2.0 and before 7.1.2 allows a local authenticated attacker to execute arbitrary shell code as `root` user via crafted CLI requests."}], "id": "CVE-2023-26210", "lastModified": "2024-11-21T07:50:55.397", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "psirt@fortinet.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2023-06-13T09:15:16.510", "references": [{"source": "psirt@fortinet.com", "tags": ["Vendor Advisory"], "url": "https://fortiguard.com/psirt/FG-IR-23-076"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://fortiguard.com/psirt/FG-IR-23-076"}], "sourceIdentifier": "psirt@fortinet.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-78"}], "source": "psirt@fortinet.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-78"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}