PT-2021-6856 · Fortinet · Fortios

Published 2021-07-06 · Updated 2022-07-12 · CVE-2021-36169

Positive Technologies (AI Summary)

CVSS v2.0

6.6

Medium

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:N

Name of the Vulnerable Software and Affected Versions FortiOS versions 6.4.x through 6.4.6 FortiOS versions 7.x through 7.0.0

Description The issue is related to a hidden functionality in Fortinet FortiOS that allows an attacker to execute unauthorized code or commands. This can be achieved via specific hex read/write operations or through the use of certain console commands, such as print str and cmd mem cli commands, which enable reading and writing hexadecimal values to any memory address. The vulnerability is associated with authorization errors in the debug functionality of FortiGate operating systems.

Recommendations For FortiOS versions 6.4.x through 6.4.6, update to version 6.4.7 or later. For FortiOS versions 7.x through 7.0.0, update to version 7.0.1 or later. As a temporary workaround, consider restricting access to the debug functionality and limiting the use of print str and cmd mem cli commands to minimize the risk of exploitation.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

BDU:2022-02332

CVE-2021-36169

Affected Products

Fortios

References · 10

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-36169 · Security Note
• https://fortiguard.com/advisory/FG-IR-21-091 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-36169 · Security Note
• https://osv.dev/vulnerability/CVE-2021-36169 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-02332 · Security Note
• https://fortiguard.com/psirt/FG-IR-21-091 · Note
• https://fortiguard.fortinet.com/psirt/FG-IR-21-091 · Note
• https://t.me/cibsecurity/33836 · Telegram Post
• https://vuldb.com/?id.188028 · Note
• https://cybersecurity-help.cz/vdb/SB2021090715 · Note