#VU117208 OS Command Injection in FortiSOAR - CVE-2024-48891
Published: October 15, 2025
Vulnerability identifier: #VU117208
Vulnerability risk: Low
CVSSv4.0: CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2024-48891
CWE-ID: CWE-78
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerable software:
FortiSOAR
FortiSOAR
Software vendor:
Fortinet, Inc
Fortinet, Inc
Description
The vulnerability allows a local authenticated user to execute arbitrary code.
The vulnerability exists due to improper neutralization of special elements used in an os command ('os command injection') in shell. An attacker who has already obtained a non-login low privileged shell access can perform a local privilege escalation via crafted commands.
Remediation
Install update from vendor's website.