Integer Overflow Vulnerability in FortiOS SSLVPN by Fortinet
CVE-2021-26109

8.1HIGH

Key Information:

Vendor

Fortinet
Status
Fortinet FortiOS
Vendor
CVE Published:
8 December 2021

What is CVE-2021-26109?

An integer overflow vulnerability exists in the memory allocator of the SSLVPN component of FortiOS, prior to version 7.0.1. This flaw may permit an unauthenticated attacker to craft malicious requests to SSLVPN, leading to potential corruption of control data on the heap and enabling the execution of arbitrary code.

Affected Version(s)

Fortinet FortiOS FortiOS before 7.0.1

References

https://fortiguard.com/advisory/FG-IR-21-049
x_refsource_CONFIRM

CVSS V3.1

Score:
8.1
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.