Vulnerabilities > CVE-2021-36173 - Out-of-bounds Write vulnerability in Fortinet Fortios

CVSS 8.8 - HIGH

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

NONE

Confidentiality impact

HIGH

Integrity impact

HIGH

Availability impact

HIGH

network

low complexity

fortinet

CWE-787

NVD

Published: 2021-12-08

Updated: 2021-12-10

Summary

A heap-based buffer overflow in the firmware signature verification function of FortiOS versions 7.0.1, 7.0.0, 6.4.0 through 6.4.6, 6.2.0 through 6.2.9, and 6.0.0 through 6.0.13 may allow an attacker to execute arbitrary code via specially crafted installation images.

Vulnerable Configurations

Part	Description	Count
OS	Fortinet Fortinet Fortios 6.0.0 Fortinet Fortios 6.0.1 Fortinet Fortios 6.0.2 Fortinet Fortios 6.0.3 Fortinet Fortios 6.0.4 Fortinet Fortios 6.0.5 Fortinet Fortios 6.0.6 Fortinet Fortios 6.0.7 Fortinet Fortios 6.0.8 Fortinet Fortios 6.0.9 Fortinet Fortios 6.0.10 Fortinet Fortios 6.0.11 Fortinet Fortios 6.0.12 Fortinet Fortios 6.0.13 Fortinet Fortios 6.2.0 Fortinet Fortios 6.2.1 Fortinet Fortios 6.2.2 Fortinet Fortios 6.2.3 Fortinet Fortios 6.2.4 Fortinet Fortios 6.2.5 Fortinet Fortios 6.2.6 Fortinet Fortios 6.2.7 Fortinet Fortios 6.2.8 Fortinet Fortios 6.2.9 Fortinet Fortios 6.4.0 Fortinet Fortios 6.4.1 Fortinet Fortios 6.4.2 Fortinet Fortios 6.4.3 Fortinet Fortios 6.4.4 Fortinet Fortios 6.4.5 Fortinet Fortios 6.4.6 Fortinet Fortios 7.0.0 Fortinet Fortios 7.0.1	33
Hardware	Fortinet Fortinet Fortigate 1100E - Fortinet Fortigate 200F - Fortinet Fortigate 2600F - Fortinet Fortigate 3500F - Fortinet Fortigate 400E - Fortinet Fortigate 600E - Fortinet Fortigate 1800F - Fortinet Fortigate 2200E - Fortinet Fortigate 3300E - Fortinet Fortigate 3600E - Fortinet Fortigate 40F - Fortinet Fortigate 60F - Fortinet Fortigate 7121F -	13

Common Weakness Enumeration (CWE)

CWE-787 - Out-of-bounds Write

References

https://fortiguard.com/advisory/FG-IR-21-115