CVE-2019-17656

moderate-risk
Published 2021-04-12

A Stack-based Buffer Overflow vulnerability in the HTTPD daemon of FortiOS 6.0.10 and below, 6.2.2 and below and FortiProxy 1.0.x, 1.1.x, 1.2.9 and below, 2.0.0 and below may allow an authenticated remote attacker to crash the service by sending a malformed PUT request to the server. Fortinet is not aware of any successful exploitation of this vulnerability that would lead to code execution.

Do I need to act?

~
2.8% chance of exploitation in next 30 days
EPSS score — moderate exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
5
CVSS 5.4/10 Medium
NETWORK / LOW complexity

Affected Products (2)

Affected Vendors

Fortinet

References (4)

Vendor Advisory https://fortiguard.com/advisory/FG-IR-19-248
Vendor Advisory https://fortiguard.com/advisory/FG-IR-21-007
Vendor Advisory https://fortiguard.com/advisory/FG-IR-19-248
Vendor Advisory https://fortiguard.com/advisory/FG-IR-21-007
34
/ 100
moderate-risk
Severity 21/34 · High
Exploitability 6/34 · Minimal
Exposure 7/34 · Low