CVE-2021-42757

Summary

A buffer overflow [CWE-121] in the TFTP client library of FortiOS before 6.4.7 and FortiOS 7.0.0 through 7.0.2, may allow an authenticated local attacker to achieve arbitrary code execution via specially crafted command line arguments.

Affected Software

VendorProductVersion RangeStatus
FortinetFortiOS7.0.0 <= 7.0.2affected
FortinetFortiOS6.4.0 <= 6.4.7affected
FortinetFortiOS6.2.0 <= 6.2.9affected
FortinetFortiOS6.0.0 <= 6.0.13affected
FortinetFortiOS5.6.0 <= 5.6.14affected
FortinetFortiOS5.4.0 <= 5.4.13affected
FortinetFortiOS5.2.0 <= 5.2.15affected
FortinetFortiOS5.0.0 <= 5.0.14affected
FortinetFortiDDoS-F6.4.0 <= 6.4.1affected
FortinetFortiDDoS-F6.3.0affected
FortinetFortiDDoS-F6.2.0 <= 6.2.2affected
FortinetFortiDDoS-F6.1.0 <= 6.1.4affected
FortinetFortiVoice6.4.0 <= 6.4.4affected
FortinetFortiVoice6.0.0 <= 6.0.10affected
FortinetFortiProxy7.0.0 <= 7.0.1affected
FortinetFortiProxy2.0.0 <= 2.0.7affected
FortinetFortiProxy1.2.0 <= 1.2.13affected
FortinetFortiProxy1.1.0 <= 1.1.6affected
FortinetFortiProxy1.0.0 <= 1.0.7affected
FortinetFortiRecorder6.4.0 <= 6.4.2affected
FortinetFortiRecorder6.0.0 <= 6.0.10affected
FortinetFortiRecorder2.7.0 <= 2.7.7affected
FortinetFortiRecorder2.6.0 <= 2.6.3affected
FortinetFortiPortal6.0.0 <= 6.0.10affected
FortinetFortiPortal5.3.0 <= 5.3.8affected
FortinetFortiPortal5.2.0 <= 5.2.6affected
FortinetFortiPortal5.1.0 <= 5.1.2affected
FortinetFortiPortal5.0.0 <= 5.0.3affected
FortinetFortiMail7.0.0 <= 7.0.2affected
FortinetFortiMail6.4.0 <= 6.4.6affected
FortinetFortiMail6.2.0 <= 6.2.7affected
FortinetFortiMail6.0.0 <= 6.0.12affected
FortinetFortiMail5.4.0 <= 5.4.12affected
FortinetFortiAnalyzer7.0.0 <= 7.0.2affected
FortinetFortiAnalyzer6.4.0 <= 6.4.7affected
FortinetFortiAnalyzer6.2.0 <= 6.2.13affected
FortinetFortiAnalyzer6.0.0 <= 6.0.12affected
FortinetFortiNDR1.5.0 <= 1.5.2affected
FortinetFortiNDR1.4.0affected
FortinetFortiNDR1.3.0 <= 1.3.1affected
FortinetFortiNDR1.2.0affected
FortinetFortiNDR1.1.0affected
FortinetFortiDDoS5.5.0 <= 5.5.1affected
FortinetFortiDDoS5.4.0 <= 5.4.3affected
FortinetFortiDDoS5.3.0 <= 5.3.2affected
FortinetFortiDDoS5.2.0affected
FortinetFortiDDoS5.1.0affected
FortinetFortiDDoS5.0.0affected
FortinetFortiDDoS4.7.0affected
FortinetFortiDDoS4.6.0affected
FortinetFortiDDoS4.5.0affected
FortinetFortiDDoS4.4.0 <= 4.4.2affected
FortinetFortiSwitch7.0.0 <= 7.0.3affected
FortinetFortiSwitch6.4.0 <= 6.4.9affected
FortinetFortiSwitch6.2.0 <= 6.2.7affected
FortinetFortiSwitch6.0.0 <= 6.0.7affected
FortinetFortiADC6.2.0 <= 6.2.2affected
FortinetFortiADC6.1.0 <= 6.1.5affected
FortinetFortiADC6.0.0 <= 6.0.4affected
FortinetFortiADC5.4.0 <= 5.4.5affected
FortinetFortiADC5.3.0 <= 5.3.7affected
FortinetFortiADC5.2.0 <= 5.2.8affected
FortinetFortiADC5.1.0 <= 5.1.7affected
FortinetFortiADC5.0.0 <= 5.0.4affected
FortinetFortiWeb6.4.0 <= 6.4.1affected
FortinetFortiWeb6.3.0 <= 6.3.16affected
FortinetFortiWeb6.2.0 <= 6.2.8affected
FortinetFortiWeb6.1.0 <= 6.1.4affected
FortinetFortiWeb6.0.0 <= 6.0.8affected
FortinetFortiWeb5.9.0 <= 5.9.2affected
FortinetFortiWeb5.8.5 <= 5.8.7affected
FortinetFortiWeb5.8.0 <= 5.8.3affected
FortinetFortiWeb5.7.0 <= 5.7.3affected
FortinetFortiWeb5.6.0 <= 5.6.2affected
FortinetFortiWeb5.5.0 <= 5.5.7affected
FortinetFortiWeb5.4.0 <= 5.4.1affected
FortinetFortiWeb5.3.0 <= 5.3.9affected
FortinetFortiWeb5.2.0 <= 5.2.4affected
FortinetFortiWeb5.1.0 <= 5.1.4affected
FortinetFortiWeb5.0.0 <= 5.0.6affected
FortinetFortiManager7.0.0 <= 7.0.2affected
FortinetFortiManager6.4.0 <= 6.4.7affected
FortinetFortiManager6.2.0 <= 6.2.13affected
FortinetFortiManager6.0.0 <= 6.0.12affected

Weaknesses

  • CWE-120: Execute unauthorized code or commands

ADP Enrichment

CVE Program Container

Additional References

References