AI analysis
Fortinet FortiSandbox has an uncaught-exception flaw (CWE-248) in how exceptional conditions are handled. A privileged attacker can send crafted HTTP requests that trigger the exception and persistently deny access to both the GUI and the CLI. The impact is availability only: confidentiality and integrity are unaffected, but administrators can be locked out of management until the condition is cleared. Affected releases are FortiSandbox 4.4 (all versions), 5.0.0 through 5.0.6, and 5.2.0 through 5.2.1. Fortinet assigned the issue (CVSS 3.1 base score 4.9); it is not in CISA KEV and no public proof-of-concept is known.
What to do: Upgrade FortiSandbox to the fixed release Fortinet lists for your branch in the PSIRT advisory; fixed version numbers are not in this dataset, so confirm them with Fortinet before patching. Until then, restrict GUI and API management to trusted admin networks, because the flaw requires a privileged account. If the GUI or CLI becomes unavailable, treat it as a possible incident and recover the appliance using Fortinet's guidance.
Affected
| Fortinet FortiSandbox | 4.4 (all versions); 5.0.0 through 5.0.6; 5.2.0 through 5.2.1 |
Estimated exposure
nichelow thousands of appliances (order-of-magnitude estimate) — FortiSandbox is a specialized enterprise malware-analysis appliance rather than a mass-market product; public install and internet-exposure counts are not in the advisory, so this is an order-of-magnitude inference from typical deployment,…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
An Uncaught Exception vulnerability [CWE-248] vulnerability in Fortinet FortiSandbox 5.2.0 through 5.2.1, FortiSandbox 5.0.0 through 5.0.6, FortiSandbox 4.4 all versions may allow a privileged attacker to deny access to the GUI and CLI persistently via crafted HTTP requests.