vulnerability

Fortinet FortiOS: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') (CVE-2021-43072)

Severity
7
CVSS
(AV:L/AC:L/Au:M/C:C/I:C/A:C)
Published
Jul 18, 2023
Added
Jul 31, 2023
Modified
Jan 30, 2025

Description

A buffer copy without checking size of input ('classic buffer overflow') in Fortinet FortiAnalyzer version 7.0.2 and below, version 6.4.7 and below, version 6.2.9 and below, version 6.0.11 and below, version 5.6.11 and below, FortiManager version 7.0.2 and below, version 6.4.7 and below, version 6.2.9 and below, version 6.0.11 and below, version 5.6.11 and below, FortiOS version 7.0.0 through 7.0.4, 6.4.0 through 6.4.8, 6.2.0 through 6.2.10, 6.0.x and FortiProxy version 7.0.0 through 7.0.3, 2.0.0 through 2.0.8, 1.2.x, 1.1.x and 1.0.x allows attacker to execute unauthorized code or commands via crafted CLI `execute restore image` and `execute certificate remote` operations with the tFTP protocol.

Solution(s)

fortios-upgrade-6_2_11fortios-upgrade-6_4_9fortios-upgrade-7_0_6
Title
NEW

Explore Exposure Command

Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.