CVE-2024-56497 Command injection in FortiMail

What is CVE-2024-56497?

CVE-2024-56497 is a medium-severity command injection vulnerability in Fortinet FortiMail, published on 14 Jan 2025. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

An improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiMail versions 7.2.0 through 7.2.4 and 7.0.0 through 7.0.6 and 6.4.0 through 6.4.7, FortiRecorder versions 7.0.0 and 6.4.0 through 6.4.4 allows attacker to execute unauthorized code or commands via the CLI.

Weakness: CWE-78

Which versions are affected by CVE-2024-56497?

It affects 2 products.

Products include Fortinet Fortimail, Fortinet Fortirecorder.

How do I fix CVE-2024-56497?

No fix has been published for CVE-2024-56497 yet. Limit exposure of the affected software until one is available.

Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.

Is CVE-2024-56497 being exploited?

There is no known exploitation of CVE-2024-56497 in the wild and no public exploit code.

Other vulnerabilities in Fortinet FortiMail

• CVE-2026-104286 Fortinet FortiMail Path Traversal Exploited Critical 9.8
• CVE-2021-36166 Auth bypass in Fortinet FortiMail Critical 9.8
• CVE-2021-24007 SQL injection in Fortinet FortiMail Critical 9.8
• CVE-2020-9294 Auth bypass in FortiMail Critical 9.8
• CVE-2023-47539 Auth bypass in FortiMail Critical 9.0

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-8qhx-f4vg-5h4h.