Buffer overflow in Fortinet FortiOS
Priority LOW 30CWE-120Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- High
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-120 and the CVSS impact.
Summary
A buffer overflow [CWE-121] in the TFTP client library of FortiOS before 6.4.7 and FortiOS 7.0.0 through 7.0.2, may allow an authenticated local attacker to achieve arbitrary code execution via specially crafted command line arguments.
Why it matters now
EPSS 0.00516 44th percentileScored 2026-11-08
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Fortinet | FortiOS | 7.0.0 – 7.0.2; 6.4.0 – 6.4.7; 6.2.0 – 6.2.9; 6.0.0 – 6.0.13; 5.6.0 – 5.6.14; 5.4.0 – 5.4.13; 5.2.0 – 5.2.15; 5.0.0 – 5.0.14 | — | No fix listed | CNA |
| Fortinet | FortiDDoS-F | 6.4.0 – 6.4.1; 6.3.0; 6.2.0 – 6.2.2; 6.1.0 – 6.1.4 | — | No fix listed | CNA |
| Fortinet | FortiVoice | 6.4.0 – 6.4.4; 6.0.0 – 6.0.10 | — | No fix listed | CNA |
| Fortinet | FortiProxy | 7.0.0 – 7.0.1; 2.0.0 – 2.0.7; 1.2.0 – 1.2.13; 1.1.0 – 1.1.6; 1.0.0 – 1.0.7 | — | No fix listed | CNA |
| Fortinet | FortiRecorder | 6.4.0 – 6.4.2; 6.0.0 – 6.0.10; 2.7.0 – 2.7.7; 2.6.0 – 2.6.3 | — | No fix listed | CNA |
| Fortinet | FortiPortal | 6.0.0 – 6.0.10; 5.3.0 – 5.3.8; 5.2.0 – 5.2.6; 5.1.0 – 5.1.2; 5.0.0 – 5.0.3 | — | No fix listed | CNA |
| Fortinet | FortiMail | 7.0.0 – 7.0.2; 6.4.0 – 6.4.6; 6.2.0 – 6.2.7; 6.0.0 – 6.0.12; 5.4.0 – 5.4.12 | — | No fix listed | CNA |
| Fortinet | FortiAnalyzer | 7.0.0 – 7.0.2; 6.4.0 – 6.4.7; 6.2.0 – 6.2.13; 6.0.0 – 6.0.12 | — | No fix listed | CNA |
| Fortinet | FortiNDR | 1.5.0 – 1.5.2; 1.4.0; 1.3.0 – 1.3.1; 1.2.0; 1.1.0 | — | No fix listed | CNA |
| Fortinet | FortiDDoS | 5.5.0 – 5.5.1; 5.4.0 – 5.4.3; 5.3.0 – 5.3.2; 5.2.0; 5.1.0; 5.0.0; 4.7.0; 4.6.0; 4.5.0; 4.4.0 – 4.4.2 | — | No fix listed | CNA |
| Fortinet | FortiSwitch | 7.0.0 – 7.0.3; 6.4.0 – 6.4.9; 6.2.0 – 6.2.7; 6.0.0 – 6.0.7 | — | No fix listed | CNA |
| Fortinet | FortiADC | 6.2.0 – 6.2.2; 6.1.0 – 6.1.5; 6.0.0 – 6.0.4; 5.4.0 – 5.4.5; 5.3.0 – 5.3.7; 5.2.0 – 5.2.8; 5.1.0 – 5.1.7; 5.0.0 – 5.0.4 | — | No fix listed | CNA |
| Fortinet | FortiWeb | 6.4.0 – 6.4.1; 6.3.0 – 6.3.16; 6.2.0 – 6.2.8; 6.1.0 – 6.1.4; 6.0.0 – 6.0.8; 5.9.0 – 5.9.2; 5.8.5 – 5.8.7; 5.8.0 – 5.8.3; 5.7.0 – 5.7.3; 5.6.0 – 5.6.2; 5.5.0 – 5.5.7; 5.4.0 – 5.4.1; 5.3.0 – 5.3.9; 5.2.0 – 5.2.4; 5.1.0 – 5.1.4; 5.0.0 – 5.0.6 | — | No fix listed | CNA |
| Fortinet | FortiManager | 7.0.0 – 7.0.2; 6.4.0 – 6.4.7; 6.2.0 – 6.2.13; 6.0.0 – 6.0.12 | — | No fix listed | CNA |
- FortiOS VendorFortinet Affected 7.0.0 – 7.0.2; 6.4.0 – 6.4.7; 6.2.0 – 6.2.9; 6.0.0 – 6.0.13; 5.6.0 – 5.6.14; 5.4.0 – 5.4.13; 5.2.0 – 5.2.15; 5.0.0 – 5.0.14 Fixed in — No fix listed CNA
- FortiDDoS-F VendorFortinet Affected 6.4.0 – 6.4.1; 6.3.0; 6.2.0 – 6.2.2; 6.1.0 – 6.1.4 Fixed in — No fix listed CNA
- FortiVoice VendorFortinet Affected 6.4.0 – 6.4.4; 6.0.0 – 6.0.10 Fixed in — No fix listed CNA
- FortiProxy VendorFortinet Affected 7.0.0 – 7.0.1; 2.0.0 – 2.0.7; 1.2.0 – 1.2.13; 1.1.0 – 1.1.6; 1.0.0 – 1.0.7 Fixed in — No fix listed CNA
- FortiRecorder VendorFortinet Affected 6.4.0 – 6.4.2; 6.0.0 – 6.0.10; 2.7.0 – 2.7.7; 2.6.0 – 2.6.3 Fixed in — No fix listed CNA
- FortiPortal VendorFortinet Affected 6.0.0 – 6.0.10; 5.3.0 – 5.3.8; 5.2.0 – 5.2.6; 5.1.0 – 5.1.2; 5.0.0 – 5.0.3 Fixed in — No fix listed CNA
- FortiMail VendorFortinet Affected 7.0.0 – 7.0.2; 6.4.0 – 6.4.6; 6.2.0 – 6.2.7; 6.0.0 – 6.0.12; 5.4.0 – 5.4.12 Fixed in — No fix listed CNA
- FortiAnalyzer VendorFortinet Affected 7.0.0 – 7.0.2; 6.4.0 – 6.4.7; 6.2.0 – 6.2.13; 6.0.0 – 6.0.12 Fixed in — No fix listed CNA
- FortiNDR VendorFortinet Affected 1.5.0 – 1.5.2; 1.4.0; 1.3.0 – 1.3.1; 1.2.0; 1.1.0 Fixed in — No fix listed CNA
- FortiDDoS VendorFortinet Affected 5.5.0 – 5.5.1; 5.4.0 – 5.4.3; 5.3.0 – 5.3.2; 5.2.0; 5.1.0; 5.0.0; 4.7.0; 4.6.0; 4.5.0; 4.4.0 – 4.4.2 Fixed in — No fix listed CNA
- FortiSwitch VendorFortinet Affected 7.0.0 – 7.0.3; 6.4.0 – 6.4.9; 6.2.0 – 6.2.7; 6.0.0 – 6.0.7 Fixed in — No fix listed CNA
- FortiADC VendorFortinet Affected 6.2.0 – 6.2.2; 6.1.0 – 6.1.5; 6.0.0 – 6.0.4; 5.4.0 – 5.4.5; 5.3.0 – 5.3.7; 5.2.0 – 5.2.8; 5.1.0 – 5.1.7; 5.0.0 – 5.0.4 Fixed in — No fix listed CNA
- FortiWeb VendorFortinet Affected 6.4.0 – 6.4.1; 6.3.0 – 6.3.16; 6.2.0 – 6.2.8; 6.1.0 – 6.1.4; 6.0.0 – 6.0.8; 5.9.0 – 5.9.2; 5.8.5 – 5.8.7; 5.8.0 – 5.8.3; 5.7.0 – 5.7.3; 5.6.0 – 5.6.2; 5.5.0 – 5.5.7; 5.4.0 – 5.4.1; 5.3.0 – 5.3.9; 5.2.0 – 5.2.4; 5.1.0 – 5.1.4; 5.0.0 – 5.0.6 Fixed in — No fix listed CNA
- FortiManager VendorFortinet Affected 7.0.0 – 7.0.2; 6.4.0 – 6.4.7; 6.2.0 – 6.2.13; 6.0.0 – 6.0.12 Fixed in — No fix listed CNA
CPE configurations NVD · 19
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:fortinet:fortiadc:*:*:*:*:*:*:*:* | 5.0.0 – 6.1.5; 6.2.0 – 6.2.2 | Vulnerable | Fortinet |
| cpe:2.3:a:fortinet:fortianalyzer:*:*:*:*:*:*:*:* | 6.0.0 – 6.4.7; 7.0.0 – 7.0.2 | Vulnerable | Fortinet |
| cpe:2.3:a:fortinet:fortimail:*:*:*:*:*:*:*:* | 5.4.0 – 6.2.7; 6.4.0 – 6.4.6; 7.0.0 – 7.0.2 | Vulnerable | Fortinet |
| cpe:2.3:a:fortinet:fortimanager:*:*:*:*:*:*:*:* | 6.0.0 – 6.4.7; 7.0.0 – 7.0.2 | Vulnerable | Fortinet |
| cpe:2.3:a:fortinet:fortindr:*:*:*:*:*:*:*:* | 1.1.0 – 1.5.2 | Vulnerable | Fortinet |
| cpe:2.3:a:fortinet:fortios-6k7k:*:*:*:*:*:*:*:* | up to 6.2.8 | Vulnerable | Fortinet |
| cpe:2.3:a:fortinet:fortios-6k7k:6.4.2:*:*:*:*:*:*:* | 6.4.2 | Vulnerable | Fortinet |
| cpe:2.3:a:fortinet:fortios-6k7k:6.4.6:*:*:*:*:*:*:* | 6.4.6 | Vulnerable | Fortinet |
| cpe:2.3:a:fortinet:fortiportal:*:*:*:*:*:*:*:* | 5.0.0 – 6.0.10 | Vulnerable | Fortinet |
| cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:* | 1.0.0 – 2.0.7 | Vulnerable | Fortinet |
- cpe:2.3:a:fortinet:fortiadc:*:*:*:*:*:*:*:* Versions 5.0.0 – 6.1.5; 6.2.0 – 6.2.2 Vulnerable ·Fortinet
- cpe:2.3:a:fortinet:fortianalyzer:*:*:*:*:*:*:*:* Versions 6.0.0 – 6.4.7; 7.0.0 – 7.0.2 Vulnerable ·Fortinet
- cpe:2.3:a:fortinet:fortimail:*:*:*:*:*:*:*:* Versions 5.4.0 – 6.2.7; 6.4.0 – 6.4.6; 7.0.0 – 7.0.2 Vulnerable ·Fortinet
- cpe:2.3:a:fortinet:fortimanager:*:*:*:*:*:*:*:* Versions 6.0.0 – 6.4.7; 7.0.0 – 7.0.2 Vulnerable ·Fortinet
- cpe:2.3:a:fortinet:fortindr:*:*:*:*:*:*:*:* Versions 1.1.0 – 1.5.2 Vulnerable ·Fortinet
- cpe:2.3:a:fortinet:fortios-6k7k:*:*:*:*:*:*:*:* Versions up to 6.2.8 Vulnerable ·Fortinet
- cpe:2.3:a:fortinet:fortios-6k7k:6.4.2:*:*:*:*:*:*:* Versions 6.4.2 Vulnerable ·Fortinet
- cpe:2.3:a:fortinet:fortios-6k7k:6.4.6:*:*:*:*:*:*:* Versions 6.4.6 Vulnerable ·Fortinet
- cpe:2.3:a:fortinet:fortiportal:*:*:*:*:*:*:*:* Versions 5.0.0 – 6.0.10 Vulnerable ·Fortinet
- cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:* Versions 1.0.0 – 2.0.7 Vulnerable ·Fortinet
Show 9 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:fortinet:fortiproxy:7.0.0:*:*:*:*:*:*:* | 7.0.0 | Vulnerable | Fortinet |
| cpe:2.3:a:fortinet:fortiproxy:7.0.1:*:*:*:*:*:*:* | 7.0.1 | Vulnerable | Fortinet |
| cpe:2.3:a:fortinet:fortivoice:*:*:*:*:*:*:*:* | 6.0.0 – 6.0.10; 6.4.0 – 6.4.4 | Vulnerable | Fortinet |
| cpe:2.3:a:fortinet:fortiweb:*:*:*:*:*:*:*:* | 5.0.0 – 6.3.16 | Vulnerable | Fortinet |
| cpe:2.3:a:fortinet:fortiweb:6.4.0:*:*:*:*:*:*:* | 6.4.0 | Vulnerable | Fortinet |
| cpe:2.3:a:fortinet:fortiweb:6.4.1:*:*:*:*:*:*:* | 6.4.1 | Vulnerable | Fortinet |
| cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:* | 5.0.0 – 6.0.13; 6.2.0 – 6.2.9; 6.4.0 – 6.4.7; 7.0.0 – 7.0.2 | Vulnerable | Fortinet |
| cpe:2.3:o:fortinet:fortirecorder_firmware:*:*:*:*:*:*:*:* | 2.6.0 – 6.0.10; 6.4.0 – 6.4.2 | Vulnerable | Fortinet |
| cpe:2.3:o:fortinet:fortiswitch:*:*:*:*:*:*:*:* | 6.0.0 – 6.4.9; 7.0.0 – 7.0.3 | Vulnerable | Fortinet |
- cpe:2.3:a:fortinet:fortiproxy:7.0.0:*:*:*:*:*:*:* Versions 7.0.0 Vulnerable ·Fortinet
- cpe:2.3:a:fortinet:fortiproxy:7.0.1:*:*:*:*:*:*:* Versions 7.0.1 Vulnerable ·Fortinet
- cpe:2.3:a:fortinet:fortivoice:*:*:*:*:*:*:*:* Versions 6.0.0 – 6.0.10; 6.4.0 – 6.4.4 Vulnerable ·Fortinet
- cpe:2.3:a:fortinet:fortiweb:*:*:*:*:*:*:*:* Versions 5.0.0 – 6.3.16 Vulnerable ·Fortinet
- cpe:2.3:a:fortinet:fortiweb:6.4.0:*:*:*:*:*:*:* Versions 6.4.0 Vulnerable ·Fortinet
- cpe:2.3:a:fortinet:fortiweb:6.4.1:*:*:*:*:*:*:* Versions 6.4.1 Vulnerable ·Fortinet
- cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:* Versions 5.0.0 – 6.0.13; 6.2.0 – 6.2.9; 6.4.0 – 6.4.7; 7.0.0 – 7.0.2 Vulnerable ·Fortinet
- cpe:2.3:o:fortinet:fortirecorder_firmware:*:*:*:*:*:*:*:* Versions 2.6.0 – 6.0.10; 6.4.0 – 6.4.2 Vulnerable ·Fortinet
- cpe:2.3:o:fortinet:fortiswitch:*:*:*:*:*:*:*:* Versions 6.0.0 – 6.4.9; 7.0.0 – 7.0.3 Vulnerable ·Fortinet
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2021-42757
- 2026-10-03 Alias added: GHSA-8xwq-gmgr-vq48
References
More Fortinet Fortiadc vulnerabilities
- TI-2018-09612 Incorrect permission assignment in Fortinet FortiOS, fortiADC KEVCVSS 3.1MEDIUM 4.3
- TI-2022-18008 An improper handling of malformed request vulnerability [CWE-228] exists in FortiADC 5.0… CVSS 3.1CRITICAL 9.8
- TI-2023-10904 A permissive cross-domain policy with untrusted domains vulnerability in Fortinet… CVSS 3.1CRITICAL 9.1
- TI-2022-18913 OS command injection in Fortinet FortiADC CVSS 3.1HIGH 8.8
- TI-2022-18001 Cross-site scripting in Fortinet FortiADC CVSS 3.1HIGH 8.8
- TI-2023-11386 Improper access control in Fortinet FortiADC CVSS 3.1HIGH 8.8
Sources
- CVE-2021-42757 · CVE Program
- CVE-2021-42757 · NVD
- FIRST EPSS
- GHSA-8xwq-gmgr-vq48 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences