CVE-2026-25690

An improper neutralization of argument delimiters in a command ('argument injection') vulnerability in Fortinet FortiDeceptor 6.0.0 through 6.0.2, FortiDeceptor 5.3.0 through 5.3.3, FortiDeceptor 5.2.0 through 5.2.1, FortiDeceptor 5.1 all versions, FortiDeceptor 5.0 all versions may allow an authenticated attacker with at least read-only admin permission to read log files via HTTP crafted requests.

CVSS v3 4.3 MEDIUM

4.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://fortiguard.fortinet.com/psirt/FG-IR-26-138	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:fortinet:fortideceptor::::::::
	cpe:2.3:a:fortinet:fortideceptor::::::::
	cpe:2.3:a:fortinet:fortideceptor::::::::
	cpe:2.3:a:fortinet:fortideceptor:5.2.0:::::::*
	cpe:2.3:a:fortinet:fortideceptor:5.2.1:::::::*

History

No history.

Information

Published : 2026-05-12 18:16

Updated : 2026-06-17 10:25

NVD link : CVE-2026-25690

Mitre link : CVE-2026-25690

CVE.ORG link : CVE-2026-25690

JSON object : View

Products Affected

fortinet

fortideceptor

CWE

CWE-88

Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')

{"id": "CVE-2026-25690", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-25690", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-12T19:00:14.405140Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "psirt@fortinet.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 2.8}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "affected": [{"source": "psirt@fortinet.com", "affectedData": [{"cpes": ["cpe:2.3:a:fortinet:fortideceptor:6.0.2:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortideceptor:6.0.1:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortideceptor:6.0.0:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortideceptor:5.3.3:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortideceptor:5.3.2:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortideceptor:5.3.1:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortideceptor:5.3.0:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortideceptor:5.2.1:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortideceptor:5.2.0:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortideceptor:5.1.0:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortideceptor:5.0.0:*:*:*:*:*:*:*"], "vendor": "Fortinet", "product": "FortiDeceptor", "versions": [{"status": "affected", "version": "6.0.0", "versionType": "semver", "lessThanOrEqual": "6.0.2"}, {"status": "affected", "version": "5.3.0", "versionType": "semver", "lessThanOrEqual": "5.3.3"}, {"status": "affected", "version": "5.2.0", "versionType": "semver", "lessThanOrEqual": "5.2.1"}, {"status": "affected", "version": "5.1.0"}, {"status": "affected", "version": "5.0.0"}], "defaultStatus": "unaffected"}]}], "published": "2026-05-12T18:16:39.540", "references": [{"url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-138", "tags": ["Vendor Advisory"], "source": "psirt@fortinet.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "psirt@fortinet.com", "description": [{"lang": "en", "value": "CWE-88"}]}], "descriptions": [{"lang": "en", "value": "An improper neutralization of argument delimiters in a command ('argument injection') vulnerability in Fortinet FortiDeceptor 6.0.0 through 6.0.2, FortiDeceptor 5.3.0 through 5.3.3, FortiDeceptor 5.2.0 through 5.2.1, FortiDeceptor 5.1 all versions, FortiDeceptor 5.0 all versions may allow an authenticated attacker with at least read-only admin permission to read log files via HTTP crafted requests."}], "lastModified": "2026-06-17T10:25:03.870", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:fortinet:fortideceptor:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "529C7194-BEA5-47FE-A317-59D85FD444FC", "versionEndIncluding": "5.1.0", "versionStartIncluding": "5.0.0"}, {"criteria": "cpe:2.3:a:fortinet:fortideceptor:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "50797191-4601-4419-815A-63F2AB1A15DB", "versionEndIncluding": "5.3.3", "versionStartIncluding": "5.3.0"}, {"criteria": "cpe:2.3:a:fortinet:fortideceptor:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E1992EF6-28F6-4E42-8E1B-3635C7F56799", "versionEndIncluding": "6.0.2", "versionStartIncluding": "6.0.0"}, {"criteria": "cpe:2.3:a:fortinet:fortideceptor:5.2.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6FA247B9-FC0D-4E38-A29A-518331F84C94"}, {"criteria": "cpe:2.3:a:fortinet:fortideceptor:5.2.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BB69110A-08A1-444F-9B67-E098D07534E4"}], "operator": "OR"}]}], "sourceIdentifier": "psirt@fortinet.com"}