CVE-2021-42757

CWE-120 — Classic Buffer OverflowCWE-787 — Out-of-bounds Write4 documents4 sources
Severity
6.7MEDIUM
EPSS
0.1%
top 77.83%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
16
Fortinet FortiadcFortinet FortianalyzerFortinet Fortiddos+13 more
Timeline
PublishedDec 8
Latest updateDec 9

Description

A buffer overflow [CWE-121] in the TFTP client library of FortiOS before 6.4.7 and FortiOS 7.0.0 through 7.0.2, may allow an authenticated local attacker to achieve arbitrary code execution via specially crafted command line arguments.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:HExploitability: 0.8 | Impact: 5.9

Affected Packages27 packages

▶CVEListV5fortinet/fortios6.0.0 — 6.0.13+7
▶NVDfortinet/fortios5.0.0 — 6.0.13+3
▶CVEListV5fortinet/fortiadc6.1.0 — 6.1.5+7
▶CVEListV5fortinet/fortindr1.5.0 — 1.5.2+4

🔴Vulnerability Details

2
GHSA
GHSA-8xwq-gmgr-vq48: A buffer overflow [CWE-121] in the TFTP client library of FortiOS before 6↗2021-12-09
▶
CVEList
CVE-2021-42757: A buffer overflow [CWE-121] in the TFTP client library of FortiOS before 6↗2021-12-08
▶

📋Vendor Advisories

1
Fortinet
A buffer overflow [CWE-121] in the TFTP client library of FortiOS before 6.4.7 and FortiOS 7.0.0 through 7.0.2, may allo...↗2021-12-08
▶