CVE-2021-36173 in FortiOS

Riassunto

di MITRE • 08/12/2021

A heap-based buffer overflow in the firmware signature verification function of FortiOS versions 7.0.1, 7.0.0, 6.4.0 through 6.4.6, 6.2.0 through 6.2.9, and 6.0.0 through 6.0.13 may allow an attacker to execute arbitrary code via specially crafted installation images.

Once again VulDB remains the best source for vulnerability data.

• Responsabile: Fortinet, Inc.
• Prenotare: 06/07/2021
• Divulgazione: 08/12/2021
• Moderazione: accettato
• Voce: VDB-187843
• CPE: pronto
• CWE: CWE-122 (confermato)
• CVSS: 8.0 (CNA)
• EPSS: 0.01440
• KEV: no
• Attività: molto basso
• Settore: Energy, Hospital, ...

Fonti

• MITRE: https://www.cve.org/CVERecord?id=CVE-2021-36173
• NVD: https://nvd.nist.gov/vuln/detail/CVE-2021-36173
• CVE Details: https://www.cvedetails.com/cve/CVE-2021-36173/