⚠ Actively exploited
Added to CISA KEV on 2021-12-10. Federal agencies required to patch by 2021-12-24. Required action: Apply updates per vendor instructions..

CVE-2021-44168

CWE-4946 documents6 sources
Severity
7.8HIGH
EPSS
1.1%
top 22.30%
CISA KEV
KEV
Added 2021-12-10
Due 2021-12-24
Exploit
Exploited in wild
Active exploitation observed
Affected products
2
Fortinet FortiosFortinet Fortinet Fortios
Timeline
KEV addedDec 10
KEV dueDec 24
PublishedJan 4
Latest updateJan 5
CISA Required Action: Apply updates per vendor instructions.

Description

A download of code without integrity check vulnerability in the "execute restore src-vis" command of FortiOS before 7.0.3 may allow a local authenticated attacker to download arbitrary files on the device via specially crafted update packages.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:NExploitability: 1.8 | Impact: 1.4

Affected Packages2 packages

▶NVDfortinet/fortios6.2.0 — 6.2.10+3
▶CVEListV5fortinet/fortinet_fortiosFortiOS before 7.0.3

🔴Vulnerability Details

3
GHSA
GHSA-689x-phc2-9p4m: A download of code without integrity check vulnerability in the "execute restore src-vis" command of FortiOS before 7↗2022-01-05
▶
CVEList
CVE-2021-44168: A download of code without integrity check vulnerability in the "execute restore src-vis" command of FortiOS before 7↗2022-01-04
▶
VulnCheck
Fortinet FortiOS Arbitrary File Download↗2021
▶

📋Vendor Advisories

2
Fortinet
A download of code without integrity check vulnerability in the "execute restore src-vis" command of FortiOS before 7.0...↗2022-01-04
▶
CISA
Fortinet FortiOS Arbitrary File Download↗2021-12-10
▶