PT-2021-7555 · Fortinet · Fortinac

Published 2021-12-07 · Updated 2022-07-12 · CVE-2021-41021

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions FortiNAC versions 8.8.8 and below FortiNAC versions 9.1.2 and below

Description The issue is related to insufficient access control in Fortinet FortiNAC, allowing an attacker to escalate privileges to the root level using the sudo command. This can be exploited by an admin user.

Recommendations For FortiNAC versions 8.8.8 and below, consider restricting the use of the sudo command until a patch is available. For FortiNAC versions 9.1.2 and below, consider restricting the use of the sudo command until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

BDU:2023-00003

CVE-2021-41021

Affected Products

Fortinac

References · 5

• https://fortiguard.com/advisory/FG-IR-21-182 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-41021 · Security Note
• https://osv.dev/vulnerability/CVE-2021-41021 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-00003 · Security Note
• https://t.me/cibsecurity/33613 · Telegram Post