CVE-2022-39947

CVSS 3.1: 8.8 high
EPSS: 3%p86
Published: Jan 3, 2023 · Jan 3, 2023
Modified: Jun 17, 2026

Analyze CVE-2022-39947 with Vani AIImpact, affected versions, exploitation status, mitigations and detection

Description · NVD

A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiADC version 7.0.0 through 7.0.2, FortiADC version 6.2.0 through 6.2.3, FortiADC version version 6.1.0 through 6.1.6, FortiADC version 6.0.0 through 6.0.4, FortiADC version 5.4.0 through 5.4.5 may allow an attacker to execute unauthorized code or commands via specifically crafted HTTP requests.

Vendors: fortinet

Products: fortiadc

Weakness: CWE-78

Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (2.9%)

In the news

2 stories

Fortinet fixed command injection bugs in FortiADC and FortiTester

Security AffairsJan 4, 15:17 UTC · Jan 4, 2023VulnerabilityExploitedCVE-2022-39947 CVE-2022-358451 · 1 read

Fortinet and Zoho Urge Customers to Patch Enterprise Software Vulnerabilities

The Hacker NewsJan 5, 07:52 UTC · Jan 5, 2023VulnerabilityCVE-2022-39947 CVE-2022-35845 CVE-2022-475233 · 1 read