CVE-2016-6909

published 2016-08-24

CVE-2016-6909: Buffer overflow in the Cookie parser in Fortinet FortiOS 4.x before 4.1.11, 4.2.x before 4.2.13, and 4.3.x before 4.3.9 and FortiSwitch before 3.4.3 allows…

Priority P1 86 critical 9.8 CVSS 3.0

AV N AC L PR N UI N S U C H I H A H

ITW EXPLOIT VulnCheck KEV

Buffer overflow in the Cookie parser in Fortinet FortiOS 4.x before 4.1.11, 4.2.x before 4.2.13, and 4.3.x before 4.3.9 and FortiSwitch before 3.4.3 allows remote attackers to execute arbitrary code via a crafted HTTP request, aka EGREGIOUSBLUNDER.

Affected

4 ranges

Vendor	Product	Version range	Fixed in
fortinet	fortios	>= 4.1.0 < 4.1.11	4.1.11
fortinet	fortios	>= 4.2.0 < 4.2.13	4.2.13
fortinet	fortios	>= 4.3.0 < 4.3.9	4.3.9
fortinet	fortiswitch	<= 3.4.2	—

Detection & IOCs extracted from sources · hover to see the quote

url https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/40276.zip↗

• → Exploit targets a buffer overflow in the HTTP Cookie parser of FortiOS; monitor for anomalously large or malformed Cookie headers in HTTP requests destined for Fortinet FortiGate/FortiSwitch management interfaces. ↗
• → The exploit is attributed to the Shadow Brokers and is publicly known as EGREGIOUSBLUNDER; threat hunting should include this keyword in log and SIEM searches. ↗

• · Affected versions span multiple FortiOS 4.x branches and FortiSwitch; ensure version checks cover FortiOS 4.x before 4.1.11, 4.2.x before 4.2.13, 4.3.x before 4.3.9, and FortiSwitch before 3.4.3 when scoping detection or patching. ↗

CVSS provenance

nvd v3.0 9.8 CRITICAL CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

nvd v2.0 10.0 CRITICAL AV:N/AC:L/Au:N/C:C/I:C/A:C

vulncheck 9.8 CRITICAL

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-119