PT-2022-12008 · Fortinet · Fortios+1

Published 2022-07-05 · Updated 2022-07-25 · CVE-2021-44170

Positive Technologies (AI Summary)

CVSS v3.1

6.7

Medium

Base vector

AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions FortiOS versions prior to 7.0.4 FortiProxy versions prior to 2.0.8

Description A stack-based buffer overflow vulnerability in the command line interpreter of FortiOS and FortiProxy may allow an authenticated attacker to execute unauthorized code or commands via specially crafted command line arguments.

Recommendations For FortiOS versions prior to 7.0.4, update to version 7.0.4 or later to resolve the issue. For FortiProxy versions prior to 2.0.8, update to version 2.0.8 or later to resolve the issue. As a temporary workaround, consider restricting access to the command line interpreter until a patch is available.

Fix

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

CVE-2021-44170

Affected Products

Fortios

Fortiproxy

References · 7

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44170 · Security Note
• https://fortiguard.com/psirt/FG-IR-21-179 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-44170 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-44170 · Security Note
• https://t.me/cvenotify/33744 · Telegram Post
• https://fortiguard.fortinet.com/psirt/FG-IR-21-179 · Note
• https://t.me/cibsecurity/46475 · Telegram Post