vulnerability

Fortinet FortiManager: Improper Neutralization of Formula Elements in a CSV File (CVE-2021-24016)

Try Surface Command

Back to search

Severity

CVSS

(AV:N/AC:M/Au:N/C:C/I:C/A:C)

Published

Sep 30, 2021

Added

Nov 30, 2021

Modified

Apr 7, 2026

Description

An improper neutralization of formula elements in a csv file in Fortinet FortiManager version 6.4.3 and below, 6.2.7 and below allows attacker to execute arbitrary commands via crafted IPv4 field in policy name, when exported as excel file and opened unsafely on the victim host.

Solutions

fortinet-fortimanager-upgrade-6_2_7fortinet-fortimanager-upgrade-6_4_3fortinet-fortimanager-upgrade-6_4_4fortinet-fortimanager-upgrade-7_2_8

References

CVE-2021-24016
https://attackerkb.com/topics/CVE-2021-24016
CWE-1236
EUVD-EUVD-2021-10936
https://euvd.enisa.europa.eu/vulnerability/EUVD-2021-10936
https://fortiguard.com/advisory/FG-IR-20-190

Rapid7 Labs

2026 Global Threat Landscape Report

The predictive window has collapsed. Exploitation follows disclosure in days. See how attackers are accelerating and how to stay ahead.

Get report