CVE-2021-44168
CVE-2021-44168
In short
A vulnerability in FortiOS allows a local authenticated user to download arbitrary files to the device when using the restore command, because the system doesn't verify if the downloaded files are legitimate before using them.
Technical detail
CWE-494 (Download of Code Without Integrity Check) in FortiOS <7.0.3 'execute restore src-vis' command allows local authenticated attackers to download and execute arbitrary files by crafting malicious update packages; requires local access and valid credentials; impacts file integrity and potential code execution on the device.
Summary generated and translated by AI from the official description.
A download of code without integrity check vulnerability in the "execute restore src-vis" command of FortiOS before 7.0.3 may allow a local authenticated attacker to download arbitrary files on the device via specially crafted update packages.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N/E:P/RL:U/RC:C
Affected products
Fortinet · Fortinet FortiOSWant to know if your infrastructure is exposed to this?
Talk to TrueHacking →