synced 10 MIN AGO
01 Record

CVE-2021-42757

A buffer overflow [CWE-121] in the TFTP client library of FortiOS before 6.4.7 and FortiOS 7.0.0 through 7.0.2, may allow an authenticated local attacker to achieve arbitrary code execution via

MediumPUBLISHEDCNA: fortinet
CNA base score6.3 CVSS v3.xCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:U/RC:C
View raw JSON

02 Description

A buffer overflow [CWE-121] in the TFTP client library of FortiOS before 6.4.7 and FortiOS 7.0.0 through 7.0.2, may allow an authenticated local attacker to achieve arbitrary code execution via

03 Exploitation and scoring

Exploitation
Not assessed. CISA has not published an exploitation assessment for this record, and it is not in the KEV catalog. That is an absence of assessment, not a finding of no risk.
SSVC decision
Not assessed by CISA
EPSS probability
0.51% probability of exploitation activity in the next 30 days.
EPSS percentile
Equal to or higher than the score of 43.6% of scored records. A rank, not a probability.
NVD base score
6.7 (CVSS v3.x), scored by the NVD independently of the CNA.
NVD CVSS vector
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
NVD analysis status
Modified. NVD last modified this record on 2026-06-17.
Red Hat severity
No Red Hat rating. Red Hat rates the CVEs that affect its products.

Exploit-prediction scores from FIRST. Independent scoring and analysis status from the NVD. Vendor severity from Red Hat. Exploitation assessment and catalog membership from CISA.

04 Metadata

Published
2021-12-08 11:01Z4 YR AGO
Last updated
2025-10-16 09:46Z1 YR AGO
Reserved
2021-10-20
Assigning CNA
fortinet
Record state
PUBLISHED
Severity
Medium (CVSS 6.3)
CNA CVSS vector
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:U/RC:C
Weaknesses
  • CWE-120Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')Base
  • CWE-787Out-of-bounds WriteBase
Data version
5.1
Document digest
49cc964a92db93d0c1ce95b73c9074202be2df0b15b201fbd82b9d8030b825b4

05 Affected products

VendorProductVersionsPlatforms
FortinetFortiOS7.0.0 to 7.0.2, 6.4.0 to 6.4.7, 6.2.0 to 6.2.9, 6.0.0 to 6.0.13, 5.6.0 to 5.6.14, 5.4.0 to 5.4.13, 5.2.0 to 5.2.15, 5.0.0 to 5.0.14—
FortinetFortiDDoS-F6.4.0 to 6.4.1, 6.3.0, 6.2.0 to 6.2.2, 6.1.0 to 6.1.4—
FortinetFortiVoice6.4.0 to 6.4.4, 6.0.0 to 6.0.10—
FortinetFortiProxy7.0.0 to 7.0.1, 2.0.0 to 2.0.7, 1.2.0 to 1.2.13, 1.1.0 to 1.1.6, 1.0.0 to 1.0.7—
FortinetFortiRecorder6.4.0 to 6.4.2, 6.0.0 to 6.0.10, 2.7.0 to 2.7.7, 2.6.0 to 2.6.3—
FortinetFortiPortal6.0.0 to 6.0.10, 5.3.0 to 5.3.8, 5.2.0 to 5.2.6, 5.1.0 to 5.1.2, 5.0.0 to 5.0.3—
FortinetFortiMail7.0.0 to 7.0.2, 6.4.0 to 6.4.6, 6.2.0 to 6.2.7, 6.0.0 to 6.0.12, 5.4.0 to 5.4.12—
FortinetFortiAnalyzer7.0.0 to 7.0.2, 6.4.0 to 6.4.7, 6.2.0 to 6.2.13, 6.0.0 to 6.0.12—
FortinetFortiNDR1.5.0 to 1.5.2, 1.4.0, 1.3.0 to 1.3.1, 1.2.0, 1.1.0—
FortinetFortiDDoS5.5.0 to 5.5.1, 5.4.0 to 5.4.3, 5.3.0 to 5.3.2, 5.2.0, 5.1.0, 5.0.0, 4.7.0, 4.6.0, 4.5.0, 4.4.0 to 4.4.2—
FortinetFortiSwitch7.0.0 to 7.0.3, 6.4.0 to 6.4.9, 6.2.0 to 6.2.7, 6.0.0 to 6.0.7—
FortinetFortiADC6.2.0 to 6.2.2, 6.1.0 to 6.1.5, 6.0.0 to 6.0.4, 5.4.0 to 5.4.5, 5.3.0 to 5.3.7, 5.2.0 to 5.2.8, 5.1.0 to 5.1.7, 5.0.0 to 5.0.4—
FortinetFortiWeb6.4.0 to 6.4.1, 6.3.0 to 6.3.16, 6.2.0 to 6.2.8, 6.1.0 to 6.1.4, 6.0.0 to 6.0.8, 5.9.0 to 5.9.2, 5.8.5 to 5.8.7, 5.8.0 to 5.8.3, 5.7.0 to 5.7.3, 5.6.0 to 5.6.2, 5.5.0 to 5.5.7, 5.4.0 to 5.4.1, 5.3.0 to 5.3.9, 5.2.0 to 5.2.4, 5.1.0 to 5.1.4, 5.0.0 to 5.0.6—
FortinetFortiManager7.0.0 to 7.0.2, 6.4.0 to 6.4.7, 6.2.0 to 6.2.13, 6.0.0 to 6.0.12—

06 References

07 Remediation

Upgrade to FortiOS version 7.0.3 or above Upgrade to FortiOS version 6.4.8 or above Upgrade to FortiOS version 6.2.10 or above Upgrade to FortiOS version 6.0.14 or above Upgrade to FortiDDoS-F version 6.4.2 or above Upgrade to FortiDDoS-F version 6.3.1 or above Upgrade to FortiDDoS-F version 6.2.3 or above Upgrade to FortiDDoS-F version 6.1.5 or above Upgrade to FortiOS-6K7K version 6.4.8 or above Upgrade to FortiOS-6K7K version 6.2.9 or above Upgrade to FortiVoice version 6.4.5 or above Upgrade to FortiVoice version 6.0.11 or above Upgrade to FortiProxy version 7.0.2 or above Upgrade to FortiProxy version 2.0.8 or above Upgrade to FortiRecorder version 7.0.0 or above Upgrade to FortiRecorder version 6.4.3 or above Upgrade to FortiRecorder version 6.0.11 or above Upgrade to upcoming FortiRecorder version 2.7.8 or above Upgrade to FortiPortal version 6.0.11 or above Upgrade to FortiMail version 7.2.0 or above Upgrade to FortiMail version 7.0.3 or above Upgrade to FortiMail version 6.4.7 or above Upgrade to FortiAnalyzer version 7.0.3 or above Upgrade to FortiAnalyzer version 6.4.8 or above Upgrade to FortiNDR version 7.0.0 or above Upgrade to FortiDDoS version 5.6.0 or above Upgrade to FortiDDoS version 5.5.2 or above Upgrade to FortiSwitch version 7.2.0 or above Upgrade to FortiSwitch version 7.0.4 or above Upgrade to FortiSwitch version 6.4.10 or above Upgrade to FortiADC version 7.0.1 or above Upgrade to FortiADC version 6.2.3 or above Upgrade to FortiADC version 6.1.6 or