CVEFinder.io

CVE-2025-53679

⚠️ high
🔍 Scan for this CVE
Summary

An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability [CWE-78] vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.2, FortiSandbox 4.4.0 through 4.4.7, FortiSandbox 4.2 all versions, FortiSandbox 4.0 all versions, FortiSandbox Cloud 24.1, FortiSandbox Cloud 23 all versions allows a remote privileged attacker to execute unauthorized code or commands via crafted HTTP or HTTPS requests.

CVSS Score
7.2
High
EPSS Score
0.3
Exploit Probability
Published Date
2025-12-09
First Seen: 2026-01-05
📊 Relative Risk Intelligence

This CVE is Moderate Risk - more severe than 55.6% of all 321,566 vulnerabilities in our database.

#142,887
Above average severity
Severity Percentile
🎯 CISA SSVC Assessment Updated: Dec 9, 2025
🔍 Exploitation Status
None
No known exploits
⚙️ Automatable
NO
Requires human interaction
💥 Technical Impact
Total
Complete system compromise possible
SSVC data provided by CISA
Last Modified 2026-02-05
Source NVD 🔗
CVSS Vector 3.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CWE IDs (Weakness Types)
CWE-78

📦 Affected Products 10

Vendor Product Status Affected Versions
fortinet fortisandbox Affected
≤ 4.4.7
fortinet fortisandbox Affected
> 4.0.0 < 4.4.8
fortinet fortisandbox Affected
≥ 5.0.0 ≤ 5.0.2
fortinet fortisandbox Affected
> 5.0.0 < 5.0.3
fortinet _fortisandbox_paas Affected
v23.1
fortinet _fortisandbox_paas Affected
v23.3
fortinet _fortisandbox_paas Affected
v23.4
fortinet _fortisandbox_paas Affected
v24.1
fortinet fortisandbox_cloud Affected
> 23.1.4245 < 23.4.4374
fortinet fortisandbox_cloud Affected
v24.1.4436

🔗 References 1

https://fortiguard.fortinet.com/psirt/FG-IR-25-454
Vendor Advisory

🔗 Related CVEs 6

CVE ID Severity CVSS EPSS Summary Published
CVE-2026-26083 ⛔ critical 9.8 0.1 A missing authorization vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.1, FortiSandbox 4.4.0 through 4.4.8, Fo... 2026-05-12
CVE-2026-39808 ⛔ critical 9.8 0.3 A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet F... 2026-04-14
CVE-2026-39812 🔶 medium 4.8 0.0 A improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Fortinet FortiSa... 2026-04-14
CVE-2026-39813 ⛔ critical 9.8 0.1 A path traversal: '../filedir' vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4.0 through 4.... 2026-04-14
CVE-2025-53608 🔶 medium 4.8 0.0 An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability [CWE-79] vulnerabi... 2026-03-10
CVE-2026-25836 ⚠️ high 7.2 0.1 An improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet ... 2026-03-10
These CVEs affect the same products