« Volver al listado

CVE-2019-15708

Estado: ModificadaMedia (6.7)—

A system command injection vulnerability in the FortiAP-S/W2 6.2.1, 6.2.0, 6.0.5 and below, FortiAP 6.0.5 and below and FortiAP-U below 6.0.0 under CLI admin console may allow unauthorized administrators to run arbitrary system level commands via specially crafted ifconfig commands.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (4)

Fortinet — FortiapFortinet — Fortiap-sFortinet — Fortiap-uFortinet — Fortiap-w2

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2019-15708",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2019-15708",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-10-24T20:03:38.903696Z"
        }
      }
    ],
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 7.2,
          "accessVector": "LOCAL",
          "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C",
          "authentication": "NONE",
          "integrityImpact": "COMPLETE",
          "accessComplexity": "LOW",
          "availabilityImpact": "COMPLETE",
          "confidentialityImpact": "COMPLETE"
        },
        "acInsufInfo": false,
        "impactScore": 10,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 3.9,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 6.7,
          "attackVector": "LOCAL",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 0.8
      }
    ]
  },
  "affected": [
    {
      "source": "psirt@fortinet.com",
      "affectedData": [
        {
          "vendor": "Fortinet",
          "product": "Fortinet FortiAP-S/W2",
          "versions": [
            {
              "status": "affected",
              "version": "6.2.1"
            },
            {
              "status": "affected",
              "version": "6.2.0"
            },
            {
              "status": "affected",
              "version": "6.0.5 and below"
            }
          ]
        },
        {
          "vendor": "Fortinet",
          "product": "Fortinet FortiAP-U",
          "versions": [
            {
              "status": "affected",
              "version": "6.0.5 and below"
            }
          ]
        },
        {
          "vendor": "Fortinet",
          "product": "Fortinet FortiAP",
          "versions": [
            {
              "status": "affected",
              "version": "below 6.0.0"
            }
          ]
        }
      ]
    }
  ],
  "published": "2020-03-15T23:15:11.327",
  "references": [
    {
      "url": "https://fortiguard.com/psirt/FG-IR-19-209",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "psirt@fortinet.com"
    },
    {
      "url": "https://fortiguard.com/psirt/FG-IR-19-209",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-78"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A system command injection vulnerability in the FortiAP-S/W2 6.2.1, 6.2.0, 6.0.5 and below, FortiAP 6.0.5 and below and FortiAP-U below 6.0.0 under CLI admin console may allow unauthorized administrators to run arbitrary system level commands via specially crafted ifconfig commands."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad de inyección de comandos de sistema en el FortiAP-S/W2 versiones 6.2.1, 6.2.0, 6.0.5 y por debajo, FortiAP versiones 6.0.5 y por debajo y FortiAP-U versiones por debajo de 6.0.0, bajo la consola de administración de la CLI puede permitir a administradores no autorizados ejecutar comandos arbitrarios a nivel de sistema por medio de comandos ifconfig especialmente diseñados ."
    }
  ],
  "lastModified": "2026-06-17T02:20:54.937",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:fortinet:fortiap:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B49D7931-B85F-43CF-A856-CAC551B94484",
              "versionEndIncluding": "6.0.5"
            },
            {
              "criteria": "cpe:2.3:a:fortinet:fortiap-s:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "44FA41F6-6B1E-4296-B221-0AA4AACCBE5D",
              "versionEndIncluding": "6.0.5"
            },
            {
              "criteria": "cpe:2.3:a:fortinet:fortiap-s:6.2.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9D024C9D-DB39-408A-B015-3DCC40512C6F"
            },
            {
              "criteria": "cpe:2.3:a:fortinet:fortiap-s:6.2.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "79A8F245-922D-42AE-9DF1-A9292A1D97C2"
            },
            {
              "criteria": "cpe:2.3:a:fortinet:fortiap-u:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "AB24E73E-8279-44F3-9DA2-76F5B0E5D7D4",
              "versionEndIncluding": "6.0.0"
            },
            {
              "criteria": "cpe:2.3:a:fortinet:fortiap-w2:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7D8279FB-CB12-4C59-901A-D96CE162E855",
              "versionEndIncluding": "6.0.5"
            },
            {
              "criteria": "cpe:2.3:a:fortinet:fortiap-w2:6.2.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "63F06A65-ADF7-4284-A00C-B5E862441722"
            },
            {
              "criteria": "cpe:2.3:a:fortinet:fortiap-w2:6.2.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FE3508FA-E206-4377-AE36-DDD6691EA3A7"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "psirt@fortinet.com"
}