An improper neutralization of special elements used in an OS command vulnerability (‘OS Command Injection’) [CWE-78] in FortiWLM may allow an authenticated attacker to execute unauthorized code or commands via crafted HTTP requests to various controllers.