This vulnerability is an improper neutralization of special elements used in an operating‑system command (OS command injection). A crafted CLI command can allow an authenticated user to execute arbitrary commands on a FortiAP device, leading to remote code execution. The flaw lies in the command parsing logic, typified by CWE‑78.

Affected are Fortinet FortiAP devices running firmware 7.6.0 through 7.6.2, 7.4.0 through 7.4.5, 7.2.x, 7.0.x, and 6.4.x, as well as FortiAP‑W2 devices running firmware 7.4.0 through 7.4.4, 7.2.x, and 7.0.x. All FortiAP‑U devices with firmware 7.0.0 through 7.0.5 are also impacted.

The CVSS base score of 6.5 indicates a moderate severity, with an EPSS score unavailable, suggesting that current threat intelligence does not indicate a high likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog, but it requires an authenticated attacker with access to the device’s CLI. An attacker could craft a malicious command string during an authenticated session to trigger arbitrary command execution on the device.