vulnerability

Fortinet FortiAnalyzer: Insufficiently Protected Credentials (CVE-2021-36170)

Try Surface Command

Back to search

Severity

CVSS

(AV:L/AC:L/Au:N/C:P/I:N/A:N)

Published

Oct 6, 2021

Added

Nov 26, 2021

Modified

Apr 7, 2026

Description

An information disclosure vulnerability [CWE-200] in FortiAnalyzerVM and FortiManagerVM versions 7.0.0 and 6.4.6 and below may allow an authenticated attacker to read the FortiCloud credentials which were used to activate the trial license in cleartext.

Solution

fortinet-fortianalyzer-upgrade-6_4_7

References

CVE-2021-36170
https://attackerkb.com/topics/CVE-2021-36170
CWE-522
EUVD-EUVD-2021-22791
https://euvd.enisa.europa.eu/vulnerability/EUVD-2021-22791
https://fortiguard.com/advisory/FG-IR-21-112

Rapid7 Labs

2026 Global Threat Landscape Report

The predictive window has collapsed. Exploitation follows disclosure in days. See how attackers are accelerating and how to stay ahead.

Get report