← Vulnerability feed

Vulnerability record · CVE-2015-3611 · published 4 February 2020

CVE-2015-3611: Fortinet fortimanager os command injection vulnerability

Fortinet · Fortimanager

A Command Injection vulnerability exists in FortiManager 5.2.1 and earlier and FortiManager 5.0.10 and earlier via unspecified vectors, which could let a malicious user run systems commands when executing a report.

8.8 CVSS 3.1 High EPSS 5.6% · top 7.4% CWE-78 · OS command injection
8.8CVSS 3.1 base score, v2 9.0
5.6%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
6References
17 Jun 2026Last modified by NVD

Description

A Command Injection vulnerability exists in FortiManager 5.2.1 and earlier and FortiManager 5.0.10 and earlier via unspecified vectors, which could let a malicious user run systems commands when executing a report.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://www.securityfocus.com/bid/74444 Third Party AdvisoryVDB Entry
http://www.securitytracker.com/id/1032188 Third Party AdvisoryVDB Entry
https://fortiguard.com/psirt/FG-IR-15-011 Vendor Advisory
http://www.securityfocus.com/bid/74444 Third Party AdvisoryVDB Entry
http://www.securitytracker.com/id/1032188 Third Party AdvisoryVDB Entry
https://fortiguard.com/psirt/FG-IR-15-011 Vendor Advisory

Track CVE-2015-3611 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2026-24858Fortinet FortiCloud SSO authentication bypass across registered devicesA CWE-288 authentication bypass in Fortinet FortiAnalyzer, FortiManager, FortiNAC-F, FortiOS, FortiProxy and FortiWeb lets an attacker with a FortiCl…KEVEPSS 86%analysed9.8CVE-2024-47575FortiManager missing authentication allows remote code executionFortiManager and FortiManager Cloud contain a missing authentication flaw in a critical function, letting specially crafted requests execute arbitrar…KEVEPSS 95%analysed9.8CVE-2023-25610Fortinet fortiweb vulnerabilityA buffer underwrite ('buffer underflow') vulnerability in the administrative interface of Fortinet FortiOS version 7.2.0 through 7.2.3, version 7.0.0…EPSS 18%9.8CVE-2024-50563Fortinet fortianalyzer vulnerabilityA weak authentication in Fortinet FortiManager Cloud, FortiAnalyzer versions 7.6.0 through 7.6.1, 7.4.1 through 7.4.3, FortiAnalyzer Cloud versions 7…EPSS 0.58%9.8CVE-2024-48886Fortinet fortianalyzer vulnerabilityA weak authentication in Fortinet FortiOS versions 7.4.0 through 7.4.4, 7.2.0 through 7.2.8, 7.0.0 through 7.0.15, 6.4.0 through 6.4.15, FortiProxy v…EPSS 0.48%9.8CVE-2024-47571Fortinet fortimanager vulnerabilityAn operation on a resource after expiration or release in Fortinet FortiManager 6.4.12 through 7.4.0 allows an attacker to gain improper access to Fo…EPSS 0.91%9.8CVE-2024-35276Fortinet fortianalyzer stack-based buffer overflow vulnerabilityA stack-based buffer overflow vulnerability in Fortinet FortiAnalyzer 7.4.0 through 7.4.3, FortiAnalyzer 7.2.0 through 7.2.5, FortiAnalyzer 7.0.0 thr…EPSS 0.42%9.8CVE-2021-32589Fortinet fortianalyzer use after free vulnerabilityA Use After Free (CWE-416) vulnerability in FortiManager version 7.0.0, version 6.4.5 and below, version 6.2.7 and below, version 6.0.10 and below, v…EPSS 8.9%

Source: NIST National Vulnerability Database (record CVE-2015-3611), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.