CVE-2021-41016

CVE Database · CVE-2021-41016

CVE-2021-41016

· HIGHModified

CVSS v3.1

7.8

EPSS

1.07%

Published

Feb 2, 2022

Modified

Nov 21, 2024

Public PoC / Exploit

All weaponized →

No public PoC or exploit code indexed for this CVE.

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

A improper neutralization of special elements used in a command ('command injection') in Fortinet FortiExtender version 7.0.1 and below, 4.2.3 and below, 4.1.7 and below allows an authenticated attacker to execute privileged shell commands via CLI commands including special characters

CVSS Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

CWE-78

Affected Products (4)

fortinet · fortiextender_firmware (up to 4.1.8)vulnerable

fortinet · fortiextender_firmware (up to 4.2.4)vulnerable

fortinet · fortiextender_firmware (up to 7.0.2)vulnerable

fortinet · fortiextender

References (2)

https://fortiguard.com/advisory/FG-IR-21-148

Vendor Advisory

https://fortiguard.com/advisory/FG-IR-21-148

Vendor Advisory

KEV Catalog EPSS Scores Vendors All CVEs