This vulnerability involves improper neutralization of special elements in OS commands within Fortinet FortiSandbox products, enabling unauthenticated remote attackers to execute arbitrary commands. Affected versions include FortiSandbox 5.0.0 to 5.0.5, 4.4.0 to 4.4.8, all 4.2 versions, and FortiSandbox Cloud and PaaS 5.0.4 to 5.0.5. The vulnerability has a CVSS 3.1 base score of 9.1, indicating critical severity with network attack vector, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability. An official fix is available from the vendor.

Successful exploitation allows unauthenticated attackers to execute arbitrary OS commands on affected FortiSandbox systems, leading to full compromise including complete confidentiality, integrity, and availability loss. This can result in unauthorized control over the affected device and potentially the network it protects.

An official fix is available and should be applied immediately to all affected FortiSandbox versions. Since this is not a cloud service, administrators must manually update their installations to the patched versions as per Fortinet's advisory. No additional mitigation steps are indicated beyond applying the official patch.