PT-2021-16957 · Fortinet · Fortiproxy+1

Published 2021-12-07 · Updated 2022-07-12 · CVE-2021-26110

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions FortiOS versions 7.0.0, 6.4.6 and below, 6.2.9 and below, 6.0.12 and below FortiProxy versions 2.0.1 and below, 1.2.9 and below

Description An improper access control issue may allow an authenticated low-privileged attacker to escalate their privileges to super admin via a specific crafted configuration of fabric automation CLI script and auto-script features.

Recommendations For FortiOS versions 7.0.0, 6.4.6 and below, 6.2.9 and below, 6.0.12 and below, consider disabling the autod daemon until a patch is available. For FortiProxy versions 2.0.1 and below, 1.2.9 and below, restrict access to the autod daemon to minimize the risk of exploitation. As a temporary workaround, consider avoiding the use of fabric automation CLI script and auto-script features until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2021-26110

Affected Products

Fortios

Fortiproxy

References · 7

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-26110 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-26110 · Security Note
• https://fortiguard.com/advisory/FG-IR-20-131 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-26110 · Vendor Advisory
• https://t.me/cvenotify/24410 · Telegram Post
• https://fortiguard.com/psirt/FG-IR-20-131 · Note
• https://fortiguard.fortinet.com/psirt/FG-IR-20-131 · Note