CVE-2019-13398: Fortinet Fcm-MB40 Firmware

High severity, CVSS 7.2. EPSS: 4.1% chance of exploitation in the next 30 days.

Dynacolor FCM-MB40 v1.2.0.0 devices allow remote attackers to execute arbitrary commands via a crafted parameter to a CGI script, as demonstrated by sed injection in cgi-bin/camctrl_save_profile.cgi (save parameter) and cgi-bin/ddns.cgi.

Affected products

• Fortinet Fcm-MB40 Firmware: version 1.2.0.0 only

Published 2019-07-08. Last modified 2026-06-17.