CVE-2021-26104

published 2022-04-06

CVE-2021-26104: Multiple OS command injection (CWE-78) vulnerabilities in the command line interface of FortiManager 6.2.7 and below, 6.4.5 and below and all versions of…

Priority P3 51 high 7.8 CVSS 3.1

AV L AC L PR L UI N S U C H I H A H

Multiple OS command injection (CWE-78) vulnerabilities in the command line interface of FortiManager 6.2.7 and below, 6.4.5 and below and all versions of 6.2.x, 6.0.x and 5.6.x, FortiAnalyzer 6.2.7 and below, 6.4.5 and below and all versions of 6.2.x, 6.0.x and 5.6.x, and FortiPortal 5.2.5 and below, 5.3.5 and below and 6.0.4 and below may allow a local authenticated and unprivileged user to execute arbitrary shell commands as root via specifically crafted CLI command parameters.

Affected

12 ranges

Vendor	Product	Version range	Fixed in
fortinet	fortianalyzer	—	—
fortinet	fortianalyzer	>= 5.6.0 < 6.0.11	6.0.11
fortinet	fortianalyzer	>= 6.2.0 < 6.2.8	6.2.8
fortinet	fortianalyzer	>= 6.4.0 < 6.4.6	6.4.6
fortinet	fortimanager	—	—
fortinet	fortimanager	>= 5.6.0 < 6.0.11	6.0.11
fortinet	fortimanager	>= 6.2.0 < 6.2.8	6.2.8
fortinet	fortimanager	>= 6.4.0 < 6.4.6	6.4.6
fortinet	fortiportal	< 5.2.6	5.2.6
fortinet	fortiportal	—	—
fortinet	fortiportal	>= 5.3.0 < 5.3.6	5.3.6
fortinet	fortiportal	>= 6.0.0 < 6.0.5	6.0.5

CVSS provenance

nvd v3.1 7.8 HIGH CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

nvd v2.0 7.2 HIGH AV:L/AC:L/Au:N/C:C/I:C/A:C

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-78