CVE-2021-36169 : A Hidden Functionality in Fortinet FortiOS 7.x before 7.0.1, FortiOS 6.4.x befor

A Hidden Functionality in Fortinet FortiOS 7.x before 7.0.1, FortiOS 6.4.x before 6.4.7 allows attacker to Execute unauthorized code or commands via specific hex read/write operations.

Published 2021-12-13 14:15:08

Updated 2022-07-12 17:42:04

Source Fortinet, Inc.

View at NVD, CVE.org

Products affected by CVE-2021-36169

Fortinet » Fortios
Versions from including (>=) 6.0.0 and up to, including, (<=) 6.0.14
cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*
Matching versions
Fortinet » Fortios
Versions from including (>=) 6.4.0 and before (<) 6.4.7
cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*
Matching versions
Fortinet » Fortios
Versions from including (>=) 6.2.0 and before (<) 6.2.10
cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*
Matching versions
Fortinet » Fortios
Versions from including (>=) 5.6.0 and up to, including, (<=) 5.6.14
cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*
Matching versions
Fortinet » Fortios » Version: 7.0.0
cpe:2.3:o:fortinet:fortios:7.0.0:*:*:*:*:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2021-36169

EPSS FAQ

0.04%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 10 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2021-36169

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
6.6	MEDIUM	AV:L/AC:L/Au:N/C:C/I:C/A:N	3.9	9.2	NIST
Access Vector: Local Access Complexity: Low Authentication: None Confidentiality Impact: Complete Integrity Impact: Complete Availability Impact: None
6.0	MEDIUM	CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N	0.8	5.2	NIST
Attack Vector: Local Attack Complexity: Low Privileges Required: High User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: None
4.2	MEDIUM	CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L	0.8	3.4	Fortinet, Inc.
Attack Vector: Local Attack Complexity: Low Privileges Required: High User Interaction: None Scope: Unchanged Confidentiality: Low Integrity: Low Availability: Low

References for CVE-2021-36169

https://fortiguard.com/advisory/FG-IR-21-091

PSIRT Advisories | FortiGuard
Vendor Advisory

Jump to

Vulnerability Details : CVE-2021-36169

Products affected by CVE-2021-36169

Exploit prediction scoring system (EPSS) score for CVE-2021-36169

CVSS scores for CVE-2021-36169

References for CVE-2021-36169