Skip to content
CVE PROGRAM SOURCE RECORD6.3 Medium

CVE-2021-42757

A buffer overflow [CWE-121] in the TFTP client library of FortiOS before 6.4.7 and FortiOS 7.0.0 through 7.0.2, may allow an authenticated local attacker to achieve arbitrary code

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
fortinet

Description

A buffer overflow [CWE-121] in the TFTP client library of FortiOS before 6.4.7 and FortiOS 7.0.0 through 7.0.2, may allow an authenticated local attacker to achieve arbitrary code execution via specially crafted command line arguments.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Fortinet FortiOS

Default version status: unaffected

  • 7.0.0 to ≤ 7.0.2affected
  • 6.4.0 to ≤ 6.4.7affected
  • 6.2.0 to ≤ 6.2.9affected
  • 6.0.0 to ≤ 6.0.13affected
  • 5.6.0 to ≤ 5.6.14affected
  • 5.4.0 to ≤ 5.4.13affected
  • 5.2.0 to ≤ 5.2.15affected
  • 5.0.0 to ≤ 5.0.14affected

Fortinet FortiDDoS-F

Default version status: unaffected

  • 6.4.0 to ≤ 6.4.1affected
  • 6.3.0affected
  • 6.2.0 to ≤ 6.2.2affected
  • 6.1.0 to ≤ 6.1.4affected

Fortinet FortiVoice

Default version status: unaffected

  • 6.4.0 to ≤ 6.4.4affected
  • 6.0.0 to ≤ 6.0.10affected

Fortinet FortiProxy

Default version status: unaffected

  • 7.0.0 to ≤ 7.0.1affected
  • 2.0.0 to ≤ 2.0.7affected
  • 1.2.0 to ≤ 1.2.13affected
  • 1.1.0 to ≤ 1.1.6affected
  • 1.0.0 to ≤ 1.0.7affected

Fortinet FortiRecorder

Default version status: unaffected

  • 6.4.0 to ≤ 6.4.2affected
  • 6.0.0 to ≤ 6.0.10affected
  • 2.7.0 to ≤ 2.7.7affected
  • 2.6.0 to ≤ 2.6.3affected

Fortinet FortiPortal

Default version status: unaffected

  • 6.0.0 to ≤ 6.0.10affected
  • 5.3.0 to ≤ 5.3.8affected
  • 5.2.0 to ≤ 5.2.6affected
  • 5.1.0 to ≤ 5.1.2affected
  • 5.0.0 to ≤ 5.0.3affected

Fortinet FortiMail

Default version status: unaffected

  • 7.0.0 to ≤ 7.0.2affected
  • 6.4.0 to ≤ 6.4.6affected
  • 6.2.0 to ≤ 6.2.7affected
  • 6.0.0 to ≤ 6.0.12affected
  • 5.4.0 to ≤ 5.4.12affected

Fortinet FortiAnalyzer

Default version status: unaffected

  • 7.0.0 to ≤ 7.0.2affected
  • 6.4.0 to ≤ 6.4.7affected
  • 6.2.0 to ≤ 6.2.13affected
  • 6.0.0 to ≤ 6.0.12affected

Fortinet FortiNDR

Default version status: unaffected

  • 1.5.0 to ≤ 1.5.2affected
  • 1.4.0affected
  • 1.3.0 to ≤ 1.3.1affected
  • 1.2.0affected
  • 1.1.0affected

Fortinet FortiDDoS

Default version status: unaffected

  • 5.5.0 to ≤ 5.5.1affected
  • 5.4.0 to ≤ 5.4.3affected
  • 5.3.0 to ≤ 5.3.2affected
  • 5.2.0affected
  • 5.1.0affected
  • 5.0.0affected
  • 4.7.0affected
  • 4.6.0affected
  • 4.5.0affected
  • 4.4.0 to ≤ 4.4.2affected

Fortinet FortiSwitch

Default version status: unaffected

  • 7.0.0 to ≤ 7.0.3affected
  • 6.4.0 to ≤ 6.4.9affected
  • 6.2.0 to ≤ 6.2.7affected
  • 6.0.0 to ≤ 6.0.7affected

Fortinet FortiADC

Default version status: unaffected

  • 6.2.0 to ≤ 6.2.2affected
  • 6.1.0 to ≤ 6.1.5affected
  • 6.0.0 to ≤ 6.0.4affected
  • 5.4.0 to ≤ 5.4.5affected
  • 5.3.0 to ≤ 5.3.7affected
  • 5.2.0 to ≤ 5.2.8affected
  • 5.1.0 to ≤ 5.1.7affected
  • 5.0.0 to ≤ 5.0.4affected

Fortinet FortiWeb

Default version status: unaffected

  • 6.4.0 to ≤ 6.4.1affected
  • 6.3.0 to ≤ 6.3.16affected
  • 6.2.0 to ≤ 6.2.8affected
  • 6.1.0 to ≤ 6.1.4affected
  • 6.0.0 to ≤ 6.0.8affected
  • 5.9.0 to ≤ 5.9.2affected
  • 5.8.5 to ≤ 5.8.7affected
  • 5.8.0 to ≤ 5.8.3affected
  • 5.7.0 to ≤ 5.7.3affected
  • 5.6.0 to ≤ 5.6.2affected
  • 5.5.0 to ≤ 5.5.7affected
  • 5.4.0 to ≤ 5.4.1affected
  • 5.3.0 to ≤ 5.3.9affected
  • 5.2.0 to ≤ 5.2.4affected
  • 5.1.0 to ≤ 5.1.4affected
  • 5.0.0 to ≤ 5.0.6affected

Fortinet FortiManager

Default version status: unaffected

  • 7.0.0 to ≤ 7.0.2affected
  • 6.4.0 to ≤ 6.4.7affected
  • 6.2.0 to ≤ 6.2.13affected
  • 6.0.0 to ≤ 6.0.12affected

References