PT-2021-7571 · Fortinet · Fortiai

Published 2021-05-05 · Updated 2022-07-12 · CVE-2021-24023

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions FortiAI version 1.4.0 and earlier

Description The issue is related to improper input validation, which may allow an authenticated user to gain system shell access via a malicious payload in the diagnose command. This can potentially lead to privilege escalation.

Recommendations For FortiAI version 1.4.0 and earlier, consider restricting access to the diagnose command until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

BDU:2023-00094

CVE-2021-24023

Affected Products

Fortiai

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2021-24023 · Security Note
• https://osv.dev/vulnerability/CVE-2021-24023 · Vendor Advisory
• https://fortiguard.com/advisory/FG-IR-21-033 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-00094 · Security Note