PT-2021-6860 · Fortinet · Fortios

Published 2021-08-12 · Updated 2025-10-16 · CVE-2021-42757

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:L/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions FortiOS versions prior to 6.4.7 FortiOS versions 7.0.0 through 7.0.2

Description A buffer overflow in the TFTP client library may allow an authenticated local attacker to achieve arbitrary code execution via specially crafted command line arguments. The issue is related to a stack-based buffer overflow, which can be exploited by an attacker to execute arbitrary code.

Recommendations For FortiOS versions prior to 6.4.7, update to version 6.4.7 or later. For FortiOS versions 7.0.0 through 7.0.2, update to a version later than 7.0.2. As a temporary workaround, consider restricting access to the TFTP client library until a patch is available.

Fix

Buffer Overflow

Stack Overflow

Memory Corruption

Weakness Enumeration

CWE-120

CWE-121

CWE-787

Related Identifiers

BDU:2022-02339

CVE-2021-42757

Affected Products

Fortios

References · 11

• https://fortiguard.com/advisory/FG-IR-21-173 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42757 · Security Note
• https://bdu.fstec.ru/vul/2022-02339 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-42757 · Security Note
• https://osv.dev/vulnerability/CVE-2021-42757 · Vendor Advisory
• https://t.me/cvenotify/67862 · Telegram Post
• https://fortiguard.fortinet.com/psirt/FG-IR-21-173 · Note
• https://t.me/cveNotify/138921 · Telegram Post
• https://vuldb.com/fr/?id.187757 · Note
• https://t.me/cvenotify/24407 · Telegram Post
• https://fortiguard.com/psirt/FG-IR-21-173 · Note