CVE-2022-29058 Command injection in Fortinet FortiAP, FortiAP-S, FortiAP-W2, FortiAP-U
An authenticated attacker can execute unauthorized OS commands on FortiAP devices via crafted arguments to existing commands.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-29058?
CVE-2022-29058 is a high-severity command injection vulnerability in Fortinet FortiAP, FortiAP-S, FortiAP-W2, FortiAP-U, published on 6 Sep 2022. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
An improper neutralization of special elements [CWE-89] used in an OS command vulnerability [CWE-78] in the command line interpreter of FortiAP 6.0.0 through 6.4.7, 7.0.0 through 7.0.3, 7.2.0, FortiAP-S 6.0.0 through 6.4.7, FortiAP-W2 6.0.0 through 6.4.7, 7.0.0 through 7.0.3, 7.2.0 and FortiAP-U 5.4.0 through 6.2.3 may allow an authenticated attacker to execute unauthorized commands via specifically crafted arguments to existing commands.
Weakness: CWE-89
Which versions are affected by CVE-2022-29058?
It affects 4 products.
Products include Fortinet Fortiap, Fortinet Fortiap-S, Fortinet Fortiap-U, Fortinet Fortiap-W2.
How do I fix CVE-2022-29058?
No fix has been published for CVE-2022-29058 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2022-29058 being exploited?
There is no known exploitation of CVE-2022-29058 in the wild and no public exploit code.
Other vulnerabilities in Fortinet FortiAP, FortiAP-S, FortiAP-W2, FortiAP-U
Sources
Also known as GHSA-48c6-w667-vv6w.