CVE-2024-26012

CVE-2024-26012 is an OS command injection vulnerability (CWE-78) due to improper neutralization of special elements used in an OS command. It affects Fortinet FortiAP-S all 6.2 versions and 6.4.0 through 6.4.9; FortiAP-W2 all 6.4 versions, all 7.0 versions, 7.2.0 through 7.2.3, and 7.4.0 through 7.4.2; and FortiAP all 6.4 versions, all 7.0 versions, 7.2.0 through 7.2.3, and 7.4.0 through 7.4.2. The issue enables a local authenticated attacker to execute unauthorized code via the CLI. It carries a CVSS v3.1 base score of 6.7 (AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), rated as medium severity.

An attacker requires local access and high-privilege authentication (PR:H) to exploit the vulnerability with low complexity (AC:L) and no user interaction. Successful exploitation allows execution of arbitrary OS commands, resulting in high impacts to confidentiality, integrity, and availability, potentially leading to full compromise of the affected FortiAP device.

Mitigation details are available in the Fortinet PSIRT advisory at https://fortiguard.fortinet.com/psirt/FG-IR-23-405. Security practitioners should consult this reference for patching instructions and workarounds specific to the affected versions.