Vulnerability · Published Jul 18, 2023 · Assigned by fortinet
CVE-2021-43072
Medium 6.3
In plain English
A medium-severity buffer overflow in FortiAnalyzer from Fortinet. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 8% of all known vulnerabilities).
Official description
A buffer copy without checking size of input ('classic buffer overflow') in Fortinet FortiAnalyzer version 7.0.2 and below, version 6.4.7 and below, version 6.2.9 and below, version 6.0.11 and below, version 5.6.11 and below, FortiManager version 7.0.2 and below, version 6.4.7 and below, version 6.2.9 and below, version 6.0.11 and below, version 5.6.11 and below, FortiOS version 7.0.0 through 7.0.4, 6.4.0 through 6.4.8, 6.2.0 through 6.2.10, 6.0.x and FortiProxy version 7.0.0 through 7.0.3, 2.0.0 through 2.0.8, 1.2.x, 1.1.x and 1.0.x allows attacker to execute unauthorized code or commands via crafted CLI `execute restore image` and `execute certificate remote` operations with the tFTP protocol.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Fortinet | FortiAnalyzer | 7.0.0 – through 7.0.26.4.0 – through 6.4.76.2.0 – through 6.2.126.0.0 – through 6.0.125.6.0 – through 5.6.11 |
| Fortinet | FortiManager | 7.0.0 – through 7.0.26.4.0 – through 6.4.76.2.0 – through 6.2.126.0.0 – through 6.0.125.6.0 – through 5.6.11 |
Weakness: CWE-120 · Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:C