3.3
Low
Exploited
CVE-2021-44168 Fortinet FortiOS Arbitrary File Download
Active exploitation observed
· CISA KEV catalogue
Required action
Apply updates per vendor instructions.
Ransomware campaigns
Not observed so far
Weakness
CWE-494
Description
A download of code without integrity check vulnerability in the "execute restore src-vis" command of FortiOS before 7.0.3 may allow a local authenticated attacker to download arbitrary files on the device via specially crafted update packages.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Fortinet FortiOS | Versions not published |
References
- fortiguard.com fortiguard.com
Timeline
- Published
- Added to the KEV catalogue
- Last modified
Other CVEs of Fortinet FortiOS
The 39 CVEs of Fortinet FortiOS →
CVE-2022-35842
An exposure of sensitive information to an unauthorized actor vulnerabiltiy [CWE-200] in FortiOS SSL-VPN versions 7.2.0,…
3.7
Low
CVE-2022-30307
A key management error vulnerability [CWE-320] affecting the RSA SSH host key in FortiOS 7.2.0 and below, 7.0.6 and…
3.9
Low
CVE-2022-38380
An improper access control [CWE-284] vulnerability in FortiOS version 7.2.0 and versions 7.0.0 through 7.0.7 may allow a…
4.3
Medium
CVE-2021-44171
A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiOS version…
9.0
Critical