FortiDDoS-F firmware versions 7.2.1 and 7.2.2 contain an SQL injection vulnerability caused by improper neutralization of special characters in SQL commands. An attacker who can send crafted HTTP requests to the device may be able to inject malicious SQL, which can lead to unauthorized execution of code or commands. This flaw could compromise the integrity of the device, potentially allowing an attacker to gain elevated privileges or disrupt service.

Fortinet’s FortiDDoS-F product is affected when deployed with firmware versions 7.2.1 and 7.2.2. The vulnerability is linked to product releases before version 7.2.3, which includes the fix.

The CVSS base score of 7.9 reflects high severity, indicating that exploitation poses a substantial risk. EPSS data is not publicly available, and the vulnerability is not listed in CISA’s KEV catalog, so no confirmed exploits are known. Based on the description, the likely attack vector is remote, via network‑based HTTP requests, and does not appear to require authenticated access, meaning any external actor could attempt injection. Consequently, the impact is high if the flaw is leveraged, emphasizing the need for timely remediation.