What’s Vulnerable › Vulnerabilities

CVE-2021-42757

• Severity: medium (CVSS 6.7 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2021-12-08 · updated 2026-06-17
• Weakness: CWE-120

Description

A buffer overflow [CWE-121] in the TFTP client library of FortiOS before 6.4.7 and FortiOS 7.0.0 through 7.0.2, may allow an authenticated local attacker to achieve arbitrary code execution via specially crafted command line arguments.

Affected products

• Fortinet FortiADC: from 5.0.0 through 6.1.5; from 6.2.0 through 6.2.2
• Fortinet FortiAnalyzer: from 6.0.0 through 6.4.7; from 7.0.0 through 7.0.2
• Fortinet FortiMail: from 5.4.0 through 6.2.7; from 6.4.0 through 6.4.6; from 7.0.0 through 7.0.2
• Fortinet FortiManager: from 6.0.0 through 6.4.7; from 7.0.0 through 7.0.2
• Fortinet FortiNDR: from 1.1.0 through 1.5.2
• Fortinet FortiOS (FortiGate): from 5.0.0 through 6.0.13; from 6.2.0 through 6.2.9; from 6.4.0 through 6.4.7; from 7.0.0 through 7.0.2
• Fortinet FortiOS-6K7K: through 6.2.8; 6.4.2, 6.4.6
• Fortinet FortiPortal: from 5.0.0 through 6.0.10
• Fortinet FortiProxy: from 1.0.0 through 2.0.7; 7.0.0, 7.0.1
• Fortinet FortiRecorder: from 2.6.0 through 6.0.10; from 6.4.0 through 6.4.2
• Fortinet FortiSwitch: from 6.0.0 through 6.4.9; from 7.0.0 through 7.0.3
• Fortinet FortiVoice: from 6.0.0 through 6.0.10; from 6.4.0 through 6.4.4
• Fortinet FortiWeb: from 5.0.0 through 6.3.16; 6.4.0, 6.4.1

References

• https://fortiguard.com/advisory/FG-IR-21-173
• https://fortiguard.com/advisory/FG-IR-21-173

Get alerted when CVE-2021-42757 or the next vulnerability affects your stack