CVE-2024-56497

MediumCVSS 6.7/10Last modified Jun 17, 2026

Description

An improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiMail versions 7.2.0 through 7.2.4 and 7.0.0 through 7.0.6 and 6.4.0 through 6.4.7, FortiRecorder versions 7.0.0 and 6.4.0 through 6.4.4 allows attacker to execute unauthorized code or commands via the CLI.

Metrics

CVSS 3.1 6.7/10CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

Vendor	Product	Versions
Fortinet	FortiMail	>= 7.2.0, <= 7.2.4; >= 7.0.0, <= 7.0.6; >= 6.4.0, <= 6.4.7
Fortinet	FortiRecorder	7.0.0; >= 6.4.0, <= 6.4.4

References

https://fortiguard.fortinet.com/psirt/FG-IR-23-170Vendor Advisory

Timeline

Published: Jan 14, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-56508.5DLL Hijacking vulnerability has been found in CENTUM CAMS Log server provided by Yokogawa Electric Corporation. If an attacker is somehow ab CVE-2024-565075.4LinkAce is a self-hosted archive to collect links of your favorite websites. Prior to 1.15.6, a reflected cross-site scripting (XSS) vulnera CVE-2024-565087.6LinkAce is a self-hosted archive to collect links of your favorite websites. Prior to 1.15.6, a file upload vulnerability exists in the Link CVE-2024-565098.6changedetection.io is a free open source web page change detection, website watcher, restock monitor and notification service. Improper inpu CVE-2024-56518.8A flaw was found in the Fence Agents Remediation operator. This vulnerability can allow a Remote Code Execution (RCE) primitive by supplying CVE-2024-565105.3@marp-team/marp-core is the core for Marp, which is the ecosystem to write your presentation with plain Markdown. Marp Core from v3.0.2 to v CVE-2024-565119.8DataEase is an open source data visualization analysis tool. Prior to 2.10.4, there is a flaw in the authentication in the io.dataease.auth.CVE-2024-565125.4Apache NiFi 1.10.0 through 2.0.0 are missing fine-grained authorization checking for Parameter Contexts, referenced Controller Services, and CVE-2024-565138.7Karmada is a Kubernetes management system that allows users to run cloud-native applications across multiple Kubernetes clusters and clouds.CVE-2024-565145.3Karmada is a Kubernetes management system that allows users to run cloud-native applications across multiple Kubernetes clusters and clouds.CVE-2024-565156.5Matrix Media Repo (MMR) is a highly configurable multi-homeserver media repository for Matrix. If SVG or JPEGXL thumbnailers are enabled (th CVE-2024-565166.9free-one-api allows users to access large language model reverse engineering libraries through the standard OpenAI API format. In versions u