This vulnerability in Fortinet FortiSandbox products arises from improper neutralization of special elements used in OS commands, leading to OS command injection. An unauthenticated attacker can exploit this by sending crafted HTTP requests to execute arbitrary commands on the affected system. The vulnerability affects multiple versions including 5.0.0 to 5.0.5, 4.4.0 to 4.4.8, and all 4.2 versions, as well as FortiSandbox Cloud and PaaS versions 5.0.4 to 5.0.5. The CVSS v3.1 base score is 9.1, indicating critical severity with network attack vector, low attack complexity, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability. An official fix is available from the vendor.

Successful exploitation allows an unauthenticated attacker to execute arbitrary OS commands on the FortiSandbox system, potentially leading to full compromise including unauthorized access, data disclosure, modification, and service disruption. The vulnerability affects confidentiality, integrity, and availability at a high level.

An official fix is available for this vulnerability. Users should apply the vendor-provided patches or updates for FortiSandbox versions 5.0.0 through 5.0.5, 4.4.0 through 4.4.8, all 4.2 versions, and FortiSandbox Cloud and PaaS 5.0.4 through 5.0.5. Since this is not a cloud service, remediation requires customer action to update affected systems. Check Fortinet's official advisories for the latest patch information and deployment instructions.