Fortinet Fortiddos-F vulnerabilities

8 known vulnerabilities affecting fortinet/fortiddos-f.

Total CVEs

8

CISA KEV

0

Public exploits

0

Exploited in wild

0

Severity breakdown

CRITICAL1HIGH3MEDIUM4

Vulnerabilities

Page 1 of 1

CVE-2024-45325MEDIUMCVSS 6.7≥ 6.1.0, < 7.0.3≥ 7.0.0, ≤ 7.0.2+6 more2025-09-09

CVE-2024-45325 [MEDIUM] CWE-78 CVE-2024-45325: An improper neutralization of special elements used in an OS command ('OS Command Injection') vulner An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerabilities [CWE-78] in Fortinet FortiDDoS-F version 7.0.0 through 7.02 and before 6.6.3 may allow a privileged attacker to execute unauthorized code or commands via crafted CLI requests.

CVE-2022-23439MEDIUMCVSS 6.1≥ 6.1.0, < 6.3.4≥ 6.3.0, ≤ 6.3.3+2 more2025-01-22

CVE-2022-23439 [MEDIUM] CWE-610 CVE-2022-23439: A externally controlled reference to a resource in another sphere vulnerability in Fortinet allows A externally controlled reference to a resource in another sphere vulnerability in Fortinet allows attacker to poison web caches via crafted HTTP requests, where the `Host` header points to an arbitrary webserver

CVE-2022-27486HIGHCVSS 7.8≥ 6.1.0, < 6.4.2v6.5.0+4 more2024-08-13

CVE-2022-27486 [MEDIUM] CWE-78 CVE-2022-27486: A improper neutralization of special elements used in an os command ('os command injection') in Fort A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiDDoS version 5.5.0 through 5.5.1, 5.4.2 through 5.4.0, 5.3.0 through 5.3.1, 5.2.0, 5.1.0, 5.0.0, 4.7.0, 4.6.0 and 4.5.0 and FortiDDoS-F version 6.3.0 through 6.3.1, 6.2.0 through 6.2.2, 6.1.0 through 6.1.4 allows an authenticated attacker to

CVE-2023-25603CRITICALCVSS 9.1≥ 6.3.0, ≤ 6.3.4v6.4.0+2 more2023-11-14

CVE-2023-25603 [MEDIUM] CWE-942 CVE-2023-25603: A permissive cross-domain policy with untrusted domains vulnerability in Fortinet FortiADC 7.1.0 - 7 A permissive cross-domain policy with untrusted domains vulnerability in Fortinet FortiADC 7.1.0 - 7.1.1, FortiDDoS-F 6.3.0 - 6.3.4 and 6.4.0 - 6.4.1 allow an unauthorized attacker to carry out privileged actions and retrieve sensitive information via crafted web requests.

CVE-2023-29177MEDIUMCVSS 6.7≥ 6.1.0, ≤ 6.1.4≥ 6.4.0, ≤ 6.4.1+5 more2023-11-14

CVE-2023-29177 [MEDIUM] CWE-120 CVE-2023-29177: Multiple buffer copy without checking size of input ('classic buffer overflow') vulnerabilities [CWE Multiple buffer copy without checking size of input ('classic buffer overflow') vulnerabilities [CWE-120] in FortiADC version 7.2.0 and before 7.1.2 & FortiDDoS-F version 6.5.0 and before 6.4.1 allows a privileged attacker to execute arbitrary code or commands via specifically crafted CLI requests.

CVE-2022-40679HIGHCVSS 7.8≥ 6.1.0, < 6.1.5≥ 6.2.0, < 6.2.3+5 more2023-04-11

CVE-2022-40679 [HIGH] CWE-78 CVE-2022-40679: An improper neutralization of special elements used in an OS command vulnerability [CWE-78] in Forti An improper neutralization of special elements used in an OS command vulnerability [CWE-78] in FortiADC 5.x all versions, 6.0 all versions, 6.1 all versions, 6.2.0 through 6.2.4, 7.0.0 through 7.0.3, 7.1.0; FortiDDoS 4.x all versions, 5.0 all versions, 5.1 all versions, 5.2 all versions, 5.3 all versions, 5.4 all versions, 5.5 all versions, 5.6 all ver

CVE-2021-36193HIGHCVSS 7.2v6.3.0≥ 6.2.0, ≤ 6.2.2+1 more2022-02-02

CVE-2021-36193 [MEDIUM] CWE-121 CVE-2021-36193: Multiple stack-based buffer overflows in the command line interpreter of FortiWeb before 6.4.2 may a Multiple stack-based buffer overflows in the command line interpreter of FortiWeb before 6.4.2 may allow an authenticated attacker to achieve arbitrary code execution via specially crafted commands.

CVE-2021-42757MEDIUMCVSS 6.7≥ 6.4.0, ≤ 6.4.1v6.3.0+2 more2021-12-08

CVE-2021-42757 [MEDIUM] CWE-120 CVE-2021-42757: A buffer overflow [CWE-121] in the TFTP client library of FortiOS before 6.4.7 and FortiOS 7.0.0 thr A buffer overflow [CWE-121] in the TFTP client library of FortiOS before 6.4.7 and FortiOS 7.0.0 through 7.0.2, may allow an authenticated local attacker to achieve arbitrary code execution via specially crafted command line arguments.