Vulnerability Description
A buffer copy without checking size of input ('classic buffer overflow') in Fortinet FortiAnalyzer version 7.0.2 and below, version 6.4.7 and below, version 6.2.9 and below, version 6.0.11 and below, version 5.6.11 and below, FortiManager version 7.0.2 and below, version 6.4.7 and below, version 6.2.9 and below, version 6.0.11 and below, version 5.6.11 and below, FortiOS version 7.0.0 through 7.0.4, 6.4.0 through 6.4.8, 6.2.0 through 6.2.10, 6.0.x and FortiProxy version 7.0.0 through 7.0.3, 2.0.0 through 2.0.8, 1.2.x, 1.1.x and 1.0.x allows attacker to execute unauthorized code or commands via crafted CLI `execute restore image` and `execute certificate remote` operations with the tFTP protocol.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Fortinet | Fortianalyzer | >= 5.6.0, < 6.4.8 |
| Fortinet | Fortimanager | >= 5.6.0, < 6.4.8 |
| Fortinet | Fortiproxy | >= 1.0.0, < 2.0.9 |
| Fortinet | Fortios | >= 6.0.0, < 6.2.11 |
Related Weaknesses (CWE)
References
- https://fortiguard.com/advisory/FG-IR-21-206Not Applicable
- https://www.fortiguard.com/psirt/FG-IR-21-206Vendor Advisory
- https://fortiguard.com/advisory/FG-IR-21-206Not Applicable
FAQ
What is CVE-2021-43072?
CVE-2021-43072 is a vulnerability with a CVSS score of 6.7 (MEDIUM). A buffer copy without checking size of input ('classic buffer overflow') in Fortinet FortiAnalyzer version 7.0.2 and below, version 6.4.7 and below, version 6.2.9 and below, version 6.0.11 and below, ...
How severe is CVE-2021-43072?
CVE-2021-43072 has been rated MEDIUM with a CVSS base score of 6.7/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2021-43072?
Check the references section above for vendor advisories and patch information. Affected products include: Fortinet Fortianalyzer, Fortinet Fortimanager, Fortinet Fortiproxy, Fortinet Fortios.