1. Home
  2. CVE Database
  3. CVE-2021-36173
HIGH · 8.0

CVE-2021-36173

A heap-based buffer overflow in the firmware signature verification function of FortiOS versions 7.0.1, 7.0.0, 6.4.0 through 6.4.6, 6.2.0 through 6.2.9, and 6.0.0 through 6.0.13 may allow an attacker ...

Vulnerability Description

A heap-based buffer overflow in the firmware signature verification function of FortiOS versions 7.0.1, 7.0.0, 6.4.0 through 6.4.6, 6.2.0 through 6.2.9, and 6.0.0 through 6.0.13 may allow an attacker to execute arbitrary code via specially crafted installation images.

CVSS Score

8.0

HIGH

CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack Vector
ADJACENT_NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
HIGH
Availability
HIGH

Affected Products

VendorProductVersions
FortinetFortios>= 6.0.0, <= 6.0.13
FortinetFortigate-1100E-
FortinetFortigate-200F-
FortinetFortigate-2600F-
FortinetFortigate-3500F-
FortinetFortigate-400E-
FortinetFortigate-600E-
FortinetFortigate 1800F-
FortinetFortigate 2200E-
FortinetFortigate 3300E-
FortinetFortigate 3600E-
FortinetFortigate 40F-
FortinetFortigate 60F-
FortinetFortigate 7121F-

Related Weaknesses (CWE)

CWE-787

References

FAQ

What is CVE-2021-36173?

CVE-2021-36173 is a vulnerability with a CVSS score of 8.0 (HIGH). A heap-based buffer overflow in the firmware signature verification function of FortiOS versions 7.0.1, 7.0.0, 6.4.0 through 6.4.6, 6.2.0 through 6.2.9, and 6.0.0 through 6.0.13 may allow an attacker ...

How severe is CVE-2021-36173?

CVE-2021-36173 has been rated HIGH with a CVSS base score of 8.0/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2021-36173?

Check the references section above for vendor advisories and patch information. Affected products include: Fortinet Fortios, Fortinet Fortigate-1100E, Fortinet Fortigate-200F, Fortinet Fortigate-2600F, Fortinet Fortigate-3500F.