CVE-2025-53680 
An improper neutralization of special elements used in an OS command ("OS Command Injection") vulnerability [CWE-78] vulnerability in Fortinet FortiAP 7.6.0 through 7.6.2, FortiAP 7.4.0 through 7.4.5, FortiAP 7.2 all versions, FortiAP 7.0 all versions, FortiAP 6.4 all versions, FortiAP-U 7.0.0 through 7.0.5, FortiAP-U 6.2 all versions, FortiAP-W2 7.4.0 through 7.4.4, FortiAP-W2 7.2 all versions, FortiAP-W2 7.0 all versions allows an authenticated privileged attacker to execute unauthorized code or commands via crafted CLI requests.
Problem types: cwe_id: CWE-78
description: Execute unauthorized code or commands
Affected products: vendor: Fortinet
product: FortiAP
cpes: cpe:2.3:a:fortinet:fortiap:7.6.2:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiap:7.6.1:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiap:7.6.0:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiap:7.4.5:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiap:7.4.4:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiap:7.4.3:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiap:7.4.2:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiap:7.4.1:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiap:7.4.0:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiap:7.2.6:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiap:7.2.5:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiap:7.2.4:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiap:7.2.3:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiap:7.2.2:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiap:7.2.1:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiap:7.2.0:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiap:7.0.7:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiap:7.0.6:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiap:7.0.5:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiap:7.0.4:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiap:7.0.3:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiap:7.0.2:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiap:7.0.1:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiap:7.0.0:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiap:6.4.9:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiap:6.4.8:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiap:6.4.7:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiap:6.4.6:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiap:6.4.5:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiap:6.4.4:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiap:6.4.3:*:*:*:*:*:*:*
default_status: unaffected
vendor: Fortinet
product: FortiAP-W2
cpes: cpe:2.3:a:fortinet:fortiap-w2:7.4.4:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiap-w2:7.4.3:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiap-w2:7.4.2:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiap-w2:7.4.1:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiap-w2:7.4.0:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiap-w2:7.2.5:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiap-w2:7.2.4:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiap-w2:7.2.3:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiap-w2:7.2.2:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiap-w2:7.2.1:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiap-w2:7.2.0:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiap-w2:7.0.8:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiap-w2:7.0.7:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiap-w2:7.0.6:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiap-w2:7.0.5:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiap-w2:7.0.4:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiap-w2:7.0.3:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiap-w2:7.0.2:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiap-w2:7.0.1:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiap-w2:7.0.0:*:*:*:*:*:*:*
default_status: unaffected
vendor: Fortinet
product: FortiAP-U
cpes: cpe:2.3:a:fortinet:fortiap-u:7.0.5:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiap-u:7.0.4:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiap-u:7.0.3:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiap-u:7.0.2:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiap-u:7.0.1:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiap-u:7.0.0:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiap-u:6.2.6:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiap-u:6.2.5:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiap-u:6.2.4:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiap-u:6.2.3:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiap-u:6.2.2:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiap-u:6.2.1:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiap-u:6.2.0:*:*:*:*:*:*:*
default_status: unaffected
CVSS v3.1: version: 3.1
attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 6.1
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
Published: 2026-05-12T16:54:15.555Z