Fortinet Fortiap-S vulnerabilities

6 CVEs affecting Fortinet Fortiap-S, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2024-26012, published 2025-01-14.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2019-17657, published 2020-04-07. High severity, CVSS 7.5. EPSS: 2.4% chance of exploitation in the next 30 days. An Uncontrolled Resource Consumption vulnerability in Fortinet FortiSwitch below 3.6.11, 6.0.6 and 6.2.2, FortiAnalyzer below 6.2.3, FortiManager below 6.2.3 and FortiAP-S/W2 below 6.2.2 may allow an…
CVE-2019-15709, published 2020-06-01. Medium severity, CVSS 6.5. EPSS: 1.3% chance of exploitation in the next 30 days. An improper input validation in FortiAP-S/W2 6.2.0 to 6.2.2, 6.0.5 and below, FortiAP-U 6.0.1 and below CLI admin console may allow unauthorized administrators to overwrite system files via specially…
CVE-2024-26012, published 2025-01-14. High severity, CVSS 7.8. EPSS: 0.7% chance of exploitation in the next 30 days. A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiAP-S 6.2 all verisons, and 6.4.0 through 6.4.9, FortiAP-W2 6.4 all versions, 7.0 all…
CVE-2019-15708, published 2020-03-15. Medium severity, CVSS 6.7. EPSS: 0.6% chance of exploitation in the next 30 days. A system command injection vulnerability in the FortiAP-S/W2 6.2.1, 6.2.0, 6.0.5 and below, FortiAP 6.0.5 and below and FortiAP-U below 6.0.0 under CLI admin console may allow unauthorized…
CVE-2022-29058, published 2022-09-06. High severity, CVSS 7.8. EPSS: 0.5% chance of exploitation in the next 30 days. An improper neutralization of special elements [CWE-89] used in an OS command vulnerability [CWE-78] in the command line interpreter of FortiAP 6.0.0 through 6.4.7, 7.0.0 through 7.0.3, 7.2.0,…
CVE-2021-26106, published 2021-07-09. High severity, CVSS 7.8. EPSS: 0.3% chance of exploitation in the next 30 days. An improper neutralization of special elements used in an OS Command vulnerability in FortiAP's console 6.4.1 through 6.4.5 and 6.2.4 through 6.2.5 may allow an authenticated attacker to execute…