Heap-Based Buffer Overflow in FortiOS Firmware Signature Verification
CVE-2021-36173

8HIGH

Key Information:

Vendor

Fortinet
Status
Fortinet FortiOS
Vendor
CVE Published:
8 December 2021

What is CVE-2021-36173?

A heap-based buffer overflow vulnerability exists in the firmware signature verification function of FortiOS, affecting various versions. This flaw may enable an attacker to craft malicious installation images, potentially leading to arbitrary code execution on the affected system. Proper updates and patches are necessary to mitigate this risk.

Affected Version(s)

Fortinet FortiOS FortiOS 7.0.1, 7.0.0, 6.4.0 through 6.4.6, 6.2.0 through 6.2.9, 6.0.0 through 6.0.13

References

https://fortiguard.com/advisory/FG-IR-21-115
x_refsource_CONFIRM

CVSS V3.1

Score:
8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.