CVE-2019-15709

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

An improper input validation in FortiAP-S/W2 6.2.0 to 6.2.2, 6.0.5 and below, FortiAP-U 6.0.1 and below CLI admin console may allow unauthorized administrators to overwrite system files via specially crafted tcpdump commands in the CLI.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H

Weakness enumeration

CWE-20

Affected software

Vendor	Product	Versions
n/a	Fortinet FortiAP-S/W2, FortiAP-U	FortiAP-S/W2 6.2.0 to 6.2.2, 6.0.5 and below, FortiAP-U 6.0.1 and below

References

https://fortiguard.com/psirt/FG-IR-19-298Vendor Advisory
https://fortiguard.com/psirt/FG-IR-19-298Vendor Advisory

Timeline

Published: Jun 1, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-15714.8The Expedition Migration tool 1.1.8 and earlier may allow an authenticated attacker to run arbitrary JavaScript or HTML in the RADIUS server CVE-2019-157107.2An OS command injection vulnerability in FortiExtender 4.1.0 to 4.1.1, 4.0.0 and below under CLI admin console may allow unauthorized admini CVE-2019-157117.8A privilege escalation vulnerability in FortiClient for Linux 6.2.1 and below may allow an user with low privilege to run system commands un CVE-2019-157127.2An improper access control vulnerability in FortiMail admin webUI 6.2.0, 6.0.0 to 6.0.6, 5.4.10 and below may allow administrators to access CVE-2019-157136.1The my-calendar plugin before 3.1.10 for WordPress has XSS.CVE-2019-157145.3cli/lib/main.js in Entropic before 2019-06-13 does not reject / and \ in command names, which might allow a directory traversal attack in un CVE-2019-157157.2MantisBT before 1.3.20 and 2.22.1 allows Post Authentication Command Injection, leading to Remote Code Execution.CVE-2019-157165.5WTF before 0.19.0 does not set the permissions of config.yml, which might make it easier for local attackers to read passwords or API keys i CVE-2019-157179.8Irssi 1.2.x before 1.2.2 has a use-after-free if the IRC server sends a double CAP.CVE-2019-157184.4In systemd 240, bus_open_system_watch_bind_with_description in shared/bus-util.c (as used by systemd-resolved to connect to the system D-Bus CVE-2019-157198.0Altair PBS Professional through 19.1.2 allows Privilege Escalation because an attacker can send a message directly to pbs_mom, which fails t CVE-2019-15727.5PAN-OS 9.0.0 may allow an unauthenticated remote user to access php files.