CVE-2021-42757

moderate-risk

Published 2021-12-08

A buffer overflow [CWE-121] in the TFTP client library of FortiOS before 6.4.7 and FortiOS 7.0.0 through 7.0.2, may allow an authenticated local attacker to achieve arbitrary code execution via specially crafted command line arguments.

Do I need to act?

0.07% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 6.7/10 Medium

LOCAL / LOW complexity

Affected Products (19)

Fortiadc

Fortianalyzer

Fortimail

Fortimanager

Fortindr

Fortios-6K7K

Fortiportal

Fortiproxy

Fortivoice

Fortiweb

Fortios

Fortirecorder Firmware

Fortiswitch

Affected Vendors

Fortinet

References (2)

Vendor Advisory https://fortiguard.com/advisory/FG-IR-21-173

/ 100

moderate-risk

Severity 21/34 · High

Exploitability 0/34 · Minimal

Exposure 19/34 · Moderate