CVE-2022-27489 | Vulnetix

CVE-2022-27489 PUBLISHED CVSS 7 HIGH

Reported by fortinet · Published February 16, 2023

A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiExtender 7.0.0 through 7.0.3, 5.3.2, 4.2.4 and below allows attacker to execute unauthorized code or commands via crafted HTTP requests.

Fixed versions

Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.

Package	Ecosystem	Fixed in
fortiextender_firmware	fortinet	7.0.4, 4.2.5, 4.1.9, 3.3.3, 3.2.4
FortiExtender	Fortinet	7.0.3

Risk scores

CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:F/RL:U/RC:C

Affected products

Vendor	Product	Versions
Fortinet	FortiExtender	7.0.0, 5.3.2, 4.2.0
Fortinet	FortiExtender	7.0.0, 5.3.2, 4.2.0

Timeline

Feb 16, 2023 CVE Published
Feb 17, 2023 EPSS Score (30 in total, the first dated here)
Oct 23, 2024 CVE Updated
Jun 2, 2026 Security Advisory
Jun 28, 2026 Coalition ESS Score

Query this with the API

The same record, from the CLI:

vulnetix vdb vuln CVE-2022-27489
vulnetix vdb fixes CVE-2022-27489

Or with curl, using the org id and key from your account page:

curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
  "https://api.vdb.vulnetix.com/v2/vuln/CVE-2022-27489/fixes/registry"

The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart

References

https://fortiguard.com/psirt/FG-IR-22-048

Look up in the Resolve Platform →