cbcvebase.

Fortinet Fortiadc vulnerabilities

44 known vulnerabilities affecting fortinet/fortiadc.

Total CVEs
44
CISA KEV
1
actively exploited
Public exploits
1
Exploited in wild
1
Severity breakdown
CRITICAL2HIGH18MEDIUM23LOW1

Vulnerabilities

Page 2 of 3
CVE-2022-22299P3HIGHCVSS 7.8≥ 6.0.0, ≤ 6.0.4≥ 6.1.0, ≤ 6.1.6+2 more2022-08-05
CVE-2022-22299 [HIGH] CWE-134 CVE-2022-22299: A format string vulnerability [CWE-134] in the command line interpreter of FortiADC version 6.0.0 th A format string vulnerability [CWE-134] in the command line interpreter of FortiADC version 6.0.0 through 6.0.4, FortiADC version 6.1.0 through 6.1.5, FortiADC version 6.2.0 through 6.2.1, FortiProxy version 1.0.0 through 1.0.7, FortiProxy version 1.1.0 through 1.1.6, FortiProxy version 1.2.0 through 1.2.13, FortiProxy version 2.0.0 through 2.0.7, For
nvd
CVE-2025-54971P3MEDIUMCVSS 6.5≥ 6.2.0, < 7.4.3v7.4.0+4 more2025-11-18
CVE-2025-54971 [MEDIUM] CWE-200 CVE-2025-54971: An exposure of sensitive information to an unauthorized actor vulnerability in Fortinet FortiADC 7.4 An exposure of sensitive information to an unauthorized actor vulnerability in Fortinet FortiADC 7.4.0, FortiADC 7.2 all versions, FortiADC 7.1 all versions, FortiADC 7.0 all versions, FortiADC 6.2 all versions may allow an admin with read-only permission to get the external resources password via the logs of the product
nvd
CVE-2021-43076P3MEDIUMCVSS 6.5≥ 5.3.0, ≤ 5.3.7≥ 5.4.0, ≤ 5.4.5+5 more2022-09-06
CVE-2021-43076 [MEDIUM] CWE-269 CVE-2021-43076: An improper privilege management vulnerability [CWE-269] in FortiADC versions 6.2.1 and below, 6.1.5 An improper privilege management vulnerability [CWE-269] in FortiADC versions 6.2.1 and below, 6.1.5 and below, 6.0.4 and below, 5.4.5 and below and 5.3.7 and below may allow a remote authenticated attacker with restricted user profile to modify the system files using the shell access.
nvd
CVE-2023-50181P3MEDIUMCVSS 6.5≥ 6.0.0, < 7.2.5≥ 7.4.0, < 7.4.2+7 more2024-07-09
CVE-2023-50181 [MEDIUM] CWE-284 CVE-2023-50181: An improper access control vulnerability [CWE-284] in Fortinet FortiADC version 7.4.0 through 7.4.1 An improper access control vulnerability [CWE-284] in Fortinet FortiADC version 7.4.0 through 7.4.1 and before 7.2.4 allows a read only authenticated attacker to perform some write actions via crafted HTTP or HTTPS requests.
nvd
CVE-2025-59921P3MEDIUMCVSS 6.5≥ 6.2.0, < 7.1.5≥ 7.2.0, < 7.2.4+5 more2025-10-14
CVE-2025-59921 [MEDIUM] CWE-200 CVE-2025-59921: An exposure of sensitive information to an unauthorized actor vulnerability [CWE-200] in Fortinet Fo An exposure of sensitive information to an unauthorized actor vulnerability [CWE-200] in Fortinet FortiADC version 7.4.0, version 7.2.3 and below, version 7.1.4 and below, 7.0 all versions, 6.2 all versions may allow an authenticated attacker to obtain sensitive data via crafted HTTP or HTTPs requests.
nvd
CVE-2022-33876P3MEDIUMCVSS 6.5≥ 5.1.0, ≤ 6.2.4v7.0.0+10 more2022-12-06
CVE-2022-33876 [MEDIUM] CWE-20 CVE-2022-33876: Multiple instances of improper input validation vulnerability in Fortinet FortiADC version 7.1.0, ve Multiple instances of improper input validation vulnerability in Fortinet FortiADC version 7.1.0, version 7.0.0 through 7.0.2 and version 6.2.4 and below allows an authenticated attacker to retrieve files with specific extension from the underlying Linux system via crafted HTTP requests.
nvd
CVE-2023-27993P3HIGHCVSS 7.1≥ 5.2.0, ≤ 7.0.5≥ 7.1.0, < 7.1.2+8 more2023-05-03
CVE-2023-27993 [HIGH] CWE-23 CVE-2023-27993: A relative path traversal [CWE-23] in Fortinet FortiADC version 7.2.0 and before 7.1.1 allows a priv A relative path traversal [CWE-23] in Fortinet FortiADC version 7.2.0 and before 7.1.1 allows a privileged attacker to delete arbitrary directories from the underlying file system via crafted CLI commands.
nvd
CVE-2023-50179P3MEDIUMCVSS 5.9≥ 7.0.0, < 7.4.1v7.4.0+3 more2024-07-09
CVE-2023-50179 [MEDIUM] CWE-295 CVE-2023-50179: An improper certificate validation vulnerability [CWE-295] in FortiADC 7.4.0, 7.2 all versions, 7.1 An improper certificate validation vulnerability [CWE-295] in FortiADC 7.4.0, 7.2 all versions, 7.1 all versions, 7.0 all versions may allow a remote and unauthenticated attacker to perform a Man-in-the-Middle attack on the communication channel between the device and public SDN connectors.
nvd
CVE-2021-24024P4MEDIUMCVSS 6.5≤ 5.3.72021-04-12
CVE-2021-24024 [MEDIUM] CWE-532 CVE-2021-24024: A clear text storage of sensitive information into log file vulnerability in FortiADCManager 5.3.0 a A clear text storage of sensitive information into log file vulnerability in FortiADCManager 5.3.0 and below, 5.2.1 and below and FortiADC 5.3.7 and below may allow a remote authenticated attacker to read other local users' password in log files.
nvd
CVE-2022-23439P4MEDIUMCVSS 6.1≥ 5.4.0, < 6.2.4≥ 7.0.0, ≤ 7.0.1+8 more2025-01-22
CVE-2022-23439 [MEDIUM] CWE-610 CVE-2022-23439: A externally controlled reference to a resource in another sphere vulnerability in Fortinet allows A externally controlled reference to a resource in another sphere vulnerability in Fortinet allows attacker to poison web caches via crafted HTTP requests, where the `Host` header points to an arbitrary webserver
nvd
CVE-2023-29177P4MEDIUMCVSS 6.7≥ 7.1.0, ≤ 7.1.2v5.2.0+14 more2023-11-14
CVE-2023-29177 [MEDIUM] CWE-120 CVE-2023-29177: Multiple buffer copy without checking size of input ('classic buffer overflow') vulnerabilities [CWE Multiple buffer copy without checking size of input ('classic buffer overflow') vulnerabilities [CWE-120] in FortiADC version 7.2.0 and before 7.1.2 & FortiDDoS-F version 6.5.0 and before 6.4.1 allows a privileged attacker to execute arbitrary code or commands via specifically crafted CLI requests.
nvd
CVE-2021-32591P4MEDIUMCVSS 5.3≥ 5.0.0, ≤ 5.4.4≥ 6.0.0, ≤ 6.0.3+3 more2021-12-08
CVE-2021-32591 [MEDIUM] CVE-2021-32591: A missing cryptographic steps vulnerability in the function that encrypts users' LDAP and RADIUS cre A missing cryptographic steps vulnerability in the function that encrypts users' LDAP and RADIUS credentials in FortiSandbox before 4.0.1, FortiWeb before 6.3.12, FortiADC before 6.2.1, FortiMail 7.0.1 and earlier may allow an attacker in possession of the password store to compromise the confidentiality of the encrypted secrets.
nvd
CVE-2021-42757P4MEDIUMCVSS 6.7≥ 5.0.0, ≤ 6.1.5≥ 6.2.0, ≤ 6.2.2+6 more2021-12-08
CVE-2021-42757 [MEDIUM] CWE-120 CVE-2021-42757: A buffer overflow [CWE-121] in the TFTP client library of FortiOS before 6.4.7 and FortiOS 7.0.0 thr A buffer overflow [CWE-121] in the TFTP client library of FortiOS before 6.4.7 and FortiOS 7.0.0 through 7.0.2, may allow an authenticated local attacker to achieve arbitrary code execution via specially crafted command line arguments.
nvd
CVE-2025-58412P4MEDIUMCVSS 6.1≥ 7.2.0, < 7.6.4v8.0.0+3 more2025-11-19
CVE-2025-58412 [MEDIUM] CWE-80 CVE-2025-58412: A improper neutralization of script-related html tags in a web page (basic xss) vulnerability in For A improper neutralization of script-related html tags in a web page (basic xss) vulnerability in Fortinet FortiADC 8.0.0, FortiADC 7.6.0 through 7.6.3, FortiADC 7.4 all versions, FortiADC 7.2 all versions may allow attacker to execute unauthorized code or commands via crafted URL.
nvd
CVE-2023-41673P4MEDIUMCVSS 5.4≥ 6.0.0, ≤ 6.0.4≥ 6.1.0, ≤ 6.1.6+9 more2023-12-13
CVE-2023-41673 [MEDIUM] CWE-285 CVE-2023-41673: An improper authorization vulnerability [CWE-285] in Fortinet FortiADC version 7.4.0 and before 7.2. An improper authorization vulnerability [CWE-285] in Fortinet FortiADC version 7.4.0 and before 7.2.2 may allow a low privileged user to read or backup the full system configuration via HTTP or HTTPS requests.
nvd
CVE-2022-38374P4MEDIUMCVSS 6.1≥ 6.2.0, < 6.2.4≥ 7.0.0, < 7.0.32022-11-02
CVE-2022-38374 [MEDIUM] CWE-79 CVE-2022-38374: A improper neutralization of input during web page generation ('cross-site scripting') in Fortinet F A improper neutralization of input during web page generation ('cross-site scripting') in Fortinet FortiADC 7.0.0 - 7.0.2 and 6.2.0 - 6.2.4 allows an attacker to execute unauthorized code or commands via the URL and User fields observed in the traffic and event logviews.
nvd
CVE-2022-35851P4MEDIUMCVSS 5.4v7.1.02022-11-02
CVE-2022-35851 [MEDIUM] CWE-79 CVE-2022-35851: An improper neutralization of input during web page generation vulnerability [CWE-79] in FortiADC ma An improper neutralization of input during web page generation vulnerability [CWE-79] in FortiADC management interface 7.1.0 may allow a remote and authenticated attacker to trigger a stored cross site scripting (XSS) attack via configuring a specially crafted IP Address.
nvd
CVE-2022-27484P4MEDIUMCVSS 4.3≥ 5.0.0, < 6.2.42022-08-03
CVE-2022-27484 [MEDIUM] CWE-287 CVE-2022-27484: A unverified password change in Fortinet FortiADC version 6.2.0 through 6.2.3, 6.1.x, 6.0.x, 5.x.x a A unverified password change in Fortinet FortiADC version 6.2.0 through 6.2.3, 6.1.x, 6.0.x, 5.x.x allows an authenticated attacker to bypass the Old Password check in the password change form via a crafted HTTP request.
nvd
CVE-2023-37933P4MEDIUMCVSS 6.1≥ 5.3.0, < 7.1.4≥ 7.2.0, < 7.2.2+9 more2025-03-11
CVE-2023-37933 [MEDIUM] CWE-79 CVE-2023-37933: An improper neutralization of input during web page generation ('Cross-site Scripting') vulnerabilit An improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability [CWE-79] in FortiADC GUI version 7.4.0, 7.2.0 through 7.2.1 and before 7.1.3 allows an authenticated attacker to perform an XSS attack via crafted HTTP or HTTPs requests.
nvd
CVE-2019-6699P4MEDIUMCVSS 5.4≤ 5.3.32020-03-13
CVE-2019-6699 [MEDIUM] CWE-79 CVE-2019-6699: An improper neutralization of input vulnerability in Fortinet FortiADC 5.3.3 and earlier may allow a An improper neutralization of input vulnerability in Fortinet FortiADC 5.3.3 and earlier may allow an attacker to execute a stored Cross Site Scripting (XSS) via a field in the traffic group interface.
nvd
← Previous2 / 3Next →