CVE-2021-36193

Published Feb 2, 2022 CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed
Description
Multiple stack-based buffer overflows in the command line interpreter of FortiWeb before 6.4.2 may allow an authenticated attacker to achieve arbitrary code execution via specially crafted commands.

Remediation

Vendor Solution

Please upgrade to FortiFone version 3.0.12 or above Please upgrade to FortiWeb version 7.0.0 or above Please upgrade to FortiWeb version 6.4.2 or above Please upgrade to FortiWeb version 6.3.17 or above Please upgrade to FortiWeb version 6.3.16 or above Please upgrade to FortiWeb version 6.2.7 or above Please upgrade to FortiRecorder version 7.0.0 or above Please upgrade to FortiRecorder version 6.4.3 or above Please upgrade to FortiRecorder version 6.0.11 or above Please upgrade to FortiVoiceEnterprise version 6.4.5 or above Please upgrade to FortiVoiceEnterprise version 6.0.11 or above Please upgrade to FortiMail version 7.2.0 or above Please upgrade to FortiMail version 7.0.3 or above Please upgrade to FortiMail version 6.4.7 or above Please upgrade to FortiMail version 6.2.9 or above Please upgrade to FortiDDoS-F version 6.3.1 or above Please upgrade to FortiDDoS-F version 6.2.3 or above Please upgrade to FortiDDoS-F version 6.1.5 or above Please upgrade to FortiADC version 7.0.1 or above Please upgrade to FortiADC version 6.2.3 or above Please upgrade to FortiADC version 6.1.7 or above Please upgrade to FortiNDR version 7.0.0 or above Please upgrade to FortiDDoS version 5.7.1 or above Please upgrade to FortiDDoS version 5.6.2 or above Please upgrade to FortiDDoS version 5.5.2 or above Please upgrade to FortiDDoS version 5.4.3 or above Please upgrade to FortiDDoS version 5.3.2 or above Please upgrade to FortiDDoS-CM version 5.7.1 or above Please upgrade to FortiDDoS-CM version 5.6.2 or above Please upgrade to FortiDDoS-CM version 5.5.2 or above Please upgrade to FortiDDoS-CM version 5.4.3 or above Please upgrade to FortiDDoS-CM version 5.3.2 or above

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
EUVD EUVD EUVD-2021-22814 Multiple stack-based buffer overflows in the command line interpreter of FortiWeb before 6.4.2 may allow an authenticated attacker to achieve arbitrary code execution via specially crafted commands.
History
Type Values Removed Values Added
Description Multiple stack-based buffer overflows in the command line interpreter of FortiWeb before 6.4.2 may allow an authenticated attacker to achieve arbitrary code execution via specially crafted commands. Multiple stack-based buffer overflows in the command line interpreter of FortiWeb before 6.4.2 may allow an authenticated attacker to achieve arbitrary code execution via specially crafted commands.
First Time appeared Fortinet fortiadc
Fortinet fortiddos
Fortinet fortiddos-f
Fortinet fortimail
Fortinet fortindr
Fortinet fortirecorder
Fortinet fortivoice
Weaknesses CWE-121
CPEs cpe:2.3:a:fortinet:fortimail:5.4.0:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortimail:5.4.10:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortimail:5.4.11:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortimail:5.4.12:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortimail:5.4.1:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortimail:5.4.2:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortimail:5.4.3:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortimail:5.4.4:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortimail:5.4.5:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortimail:5.4.6:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortimail:5.4.7:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortimail:5.4.8:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortimail:5.4.9:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortimail:6.0.0:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortimail:6.0.10:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortimail:6.0.11:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortimail:6.0.12:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortimail:6.0.1:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortimail:6.0.2:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortimail:6.0.3:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortimail:6.0.4:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortimail:6.0.5:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortimail:6.0.6:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortimail:6.0.7:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortimail:6.0.8:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortimail:6.0.9:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortimail:6.2.0:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortimail:6.2.1:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortimail:6.2.2:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortimail:6.2.3:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortimail:6.2.4:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortimail:6.2.5:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortimail:6.2.6:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortimail:6.2.7:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortimail:6.2.8:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortimail:6.4.0:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortimail:6.4.1:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortimail:6.4.2:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortimail:6.4.3:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortimail:6.4.4:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortimail:6.4.5:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortimail:6.4.6:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortimail:7.0.0:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortimail:7.0.1:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortimail:7.0.2:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortindr:1.1.0:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortindr:1.2.0:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortindr:1.3.0:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortindr:1.3.1:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortindr:1.4.0:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortindr:1.5.0:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortindr:1.5.1:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortindr:1.5.2:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortindr:1.5.3:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortirecorder:2.6.0:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortirecorder:2.6.1:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortirecorder:2.6.2:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortirecorder:2.6.3:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortirecorder:2.7.0:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortirecorder:2.7.1:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortirecorder:2.7.2:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortirecorder:2.7.3:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortirecorder:2.7.4:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortirecorder:2.7.5:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortirecorder:2.7.6:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortirecorder:2.7.7:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortirecorder:6.0.0:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortirecorder:6.0.10:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortirecorder:6.0.1:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortirecorder:6.0.2:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortirecorder:6.0.3:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortirecorder:6.0.4:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortirecorder:6.0.5:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortirecorder:6.0.6:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortirecorder:6.0.7:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortirecorder:6.0.8:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortirecorder:6.0.9:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortirecorder:6.4.0:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortirecorder:6.4.1:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortirecorder:6.4.2:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortivoice:6.0.0:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortivoice:6.0.10:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortivoice:6.0.1:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortivoice:6.0.2:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortivoice:6.0.3:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortivoice:6.0.4:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortivoice:6.0.5:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortivoice:6.0.6:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortivoice:6.0.7:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortivoice:6.0.8:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortivoice:6.0.9:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortivoice:6.4.0:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortivoice:6.4.1:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortivoice:6.4.2:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortivoice:6.4.3:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortivoice:6.4.4:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiweb:6.3.0:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiweb:6.3.10:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiweb:6.3.11:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiweb:6.3.12:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiweb:6.3.13:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiweb:6.3.14:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiweb:6.3.15:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiweb:6.3.1:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiweb:6.3.2:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiweb:6.3.3:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiweb:6.3.4:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiweb:6.3.5:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiweb:6.3.6:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiweb:6.3.7:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiweb:6.3.8:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiweb:6.3.9:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiweb:6.4.0:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiweb:6.4.1:*:*:*:*:*:*:*
cpe:2.3:h:fortinet:fortiadc:5.0.0:*:*:*:*:*:*:*
cpe:2.3:h:fortinet:fortiadc:5.0.1:*:*:*:*:*:*:*
cpe:2.3:h:fortinet:fortiadc:5.0.2:*:*:*:*:*:*:*
cpe:2.3:h:fortinet:fortiadc:5.0.3:*:*:*:*:*:*:*
cpe:2.3:h:fortinet:fortiadc:5.0.4:*:*:*:*:*:*:*
cpe:2.3:h:fortinet:fortiadc:5.1.0:*:*:*:*:*:*:*
cpe:2.3:h:fortinet:fortiadc:5.1.1:*:*:*:*:*:*:*
cpe:2.3:h:fortinet:fortiadc:5.1.2:*:*:*:*:*:*:*
cpe:2.3:h:fortinet:fortiadc:5.1.3:*:*:*:*:*:*:*
cpe:2.3:h:fortinet:fortiadc:5.1.4:*:*:*:*:*:*:*
cpe:2.3:h:fortinet:fortiadc:5.1.5:*:*:*:*:*:*:*
cpe:2.3:h:fortinet:fortiadc:5.1.6:*:*:*:*:*:*:*
cpe:2.3:h:fortinet:fortiadc:5.1.7:*:*:*:*:*:*:*
cpe:2.3:h:fortinet:fortiadc:5.2.0:*:*:*:*:*:*:*
cpe:2.3:h:fortinet:fortiadc:5.2.1:*:*:*:*:*:*:*
cpe:2.3:h:fortinet:fortiadc:5.2.2:*:*:*:*:*:*:*
cpe:2.3:h:fortinet:fortiadc:5.2.3:*:*:*:*:*:*:*
cpe:2.3:h:fortinet:fortiadc:5.2.4:*:*:*:*:*:*:*
cpe:2.3:h:fortinet:fortiadc:5.2.5:*:*:*:*:*:*:*
cpe:2.3:h:fortinet:fortiadc:5.2.6:*:*:*:*:*:*:*
cpe:2.3:h:fortinet:fortiadc:5.2.7:*:*:*:*:*:*:*
cpe:2.3:h:fortinet:fortiadc:5.2.8:*:*:*:*:*:*:*
cpe:2.3:h:fortinet:fortiadc:5.3.0:*:*:*:*:*:*:*
cpe:2.3:h:fortinet:fortiadc:5.3.1:*:*:*:*:*:*:*
cpe:2.3:h:fortinet:fortiadc:5.3.2:*:*:*:*:*:*:*
cpe:2.3:h:fortinet:fortiadc:5.3.3:*:*:*:*:*:*:*
cpe:2.3:h:fortinet:fortiadc:5.3.4:*:*:*:*:*:*:*
cpe:2.3:h:fortinet:fortiadc:5.3.5:*:*:*:*:*:*:*
cpe:2.3:h:fortinet:fortiadc:5.3.6:*:*:*:*:*:*:*
cpe:2.3:h:fortinet:fortiadc:5.3.7:*:*:*:*:*:*:*
cpe:2.3:h:fortinet:fortiadc:5.4.0:*:*:*:*:*:*:*
cpe:2.3:h:fortinet:fortiadc:5.4.1:*:*:*:*:*:*:*
cpe:2.3:h:fortinet:fortiadc:5.4.2:*:*:*:*:*:*:*
cpe:2.3:h:fortinet:fortiadc:5.4.3:*:*:*:*:*:*:*
cpe:2.3:h:fortinet:fortiadc:5.4.4:*:*:*:*:*:*:*
cpe:2.3:h:fortinet:fortiadc:5.4.5:*:*:*:*:*:*:*
cpe:2.3:h:fortinet:fortiadc:6.0.0:*:*:*:*:*:*:*
cpe:2.3:h:fortinet:fortiadc:6.0.1:*:*:*:*:*:*:*
cpe:2.3:h:fortinet:fortiadc:6.0.2:*:*:*:*:*:*:*
cpe:2.3:h:fortinet:fortiadc:6.0.3:*:*:*:*:*:*:*
cpe:2.3:h:fortinet:fortiadc:6.0.4:*:*:*:*:*:*:*
cpe:2.3:h:fortinet:fortiadc:6.1.0:*:*:*:*:*:*:*
cpe:2.3:h:fortinet:fortiadc:6.1.1:*:*:*:*:*:*:*
cpe:2.3:h:fortinet:fortiadc:6.1.2:*:*:*:*:*:*:*
cpe:2.3:h:fortinet:fortiadc:6.1.3:*:*:*:*:*:*:*
cpe:2.3:h:fortinet:fortiadc:6.1.4:*:*:*:*:*:*:*
cpe:2.3:h:fortinet:fortiadc:6.1.5:*:*:*:*:*:*:*
cpe:2.3:h:fortinet:fortiadc:6.1.6:*:*:*:*:*:*:*
cpe:2.3:h:fortinet:fortiadc:6.2.0:*:*:*:*:*:*:*
cpe:2.3:h:fortinet:fortiadc:6.2.1:*:*:*:*:*:*:*
cpe:2.3:h:fortinet:fortiadc:6.2.2:*:*:*:*:*:*:*
cpe:2.3:h:fortinet:fortiadc:7.0.0:*:*:*:*:*:*:*
cpe:2.3:o:fortinet:fortiddos-f:6.1.0:*:*:*:*:*:*:*
cpe:2.3:o:fortinet:fortiddos-f:6.1.1:*:*:*:*:*:*:*
cpe:2.3:o:fortinet:fortiddos-f:6.1.2:*:*:*:*:*:*:*
cpe:2.3:o:fortinet:fortiddos-f:6.1.3:*:*:*:*:*:*:*
cpe:2.3:o:fortinet:fortiddos-f:6.1.4:*:*:*:*:*:*:*
cpe:2.3:o:fortinet:fortiddos-f:6.2.0:*:*:*:*:*:*:*
cpe:2.3:o:fortinet:fortiddos-f:6.2.1:*:*:*:*:*:*:*
cpe:2.3:o:fortinet:fortiddos-f:6.2.2:*:*:*:*:*:*:*
cpe:2.3:o:fortinet:fortiddos-f:6.3.0:*:*:*:*:*:*:*
cpe:2.3:o:fortinet:fortiddos:4.4.0:*:*:*:*:*:*:*
cpe:2.3:o:fortinet:fortiddos:4.4.1:*:*:*:*:*:*:*
cpe:2.3:o:fortinet:fortiddos:4.4.2:*:*:*:*:*:*:*
cpe:2.3:o:fortinet:fortiddos:4.5.0:*:*:*:*:*:*:*
cpe:2.3:o:fortinet:fortiddos:4.6.0:*:*:*:*:*:*:*
cpe:2.3:o:fortinet:fortiddos:4.7.0:*:*:*:*:*:*:*
cpe:2.3:o:fortinet:fortiddos:5.0.0:*:*:*:*:*:*:*
cpe:2.3:o:fortinet:fortiddos:5.1.0:*:*:*:*:*:*:*
cpe:2.3:o:fortinet:fortiddos:5.2.0:*:*:*:*:*:*:*
cpe:2.3:o:fortinet:fortiddos:5.3.0:*:*:*:*:*:*:*
cpe:2.3:o:fortinet:fortiddos:5.3.1:*:*:*:*:*:*:*
cpe:2.3:o:fortinet:fortiddos:5.3.2:*:*:*:*:*:*:*
cpe:2.3:o:fortinet:fortiddos:5.4.0:*:*:*:*:*:*:*
cpe:2.3:o:fortinet:fortiddos:5.4.1:*:*:*:*:*:*:*
cpe:2.3:o:fortinet:fortiddos:5.4.2:*:*:*:*:*:*:*
cpe:2.3:o:fortinet:fortiddos:5.4.3:*:*:*:*:*:*:*
cpe:2.3:o:fortinet:fortiddos:5.5.0:*:*:*:*:*:*:*
cpe:2.3:o:fortinet:fortiddos:5.5.1:*:*:*:*:*:*:*
cpe:2.3:o:fortinet:fortiddos:5.6.0:*:*:*:*:*:*:*
cpe:2.3:o:fortinet:fortiddos:5.6.1:*:*:*:*:*:*:*
cpe:2.3:o:fortinet:fortiddos:5.7.0:*:*:*:*:*:*:*
Vendors & Products Fortinet fortiadc
Fortinet fortiddos
Fortinet fortiddos-f
Fortinet fortimail
Fortinet fortindr
Fortinet fortirecorder
Fortinet fortivoice
Metrics cvssV3_1

{'score': 6.7, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:U/RC:C'}

cvssV3_1

{'score': 6.3, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:U/RC:C'}

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Weaknesses

Sources

Status
PUBLISHED
Assigner
fortinet
Published
Updated
Jan 13, 2026, 4:32 PM
Reserved
Jul 6, 2021, 12:00 AM
Status
Modified
Published
Feb 2, 2022, 12:15 PM
Modified
Jun 17, 2026, 3:58 AM