Skip to content
OpenAdvisories
Medium · 6.3 CVE-2021-36193 EUVD-2021-22814GHSA-xfch-762x-q3v9

Multiple stack-based buffer overflows in the command line interpreter of FortiWeb before 6.4.2 may allow an authenticated attacker to achie…

Published Feb 2, 2022 · Updated Jan 13, 2026 · Assigned by fortinet

Vendor: Fortinet Product: FortiADC Product: FortiDDoS Product: FortiDDoS-CM Product: FortiDDoS-F Product: FortiFone Product: FortiMail Product: FortiNDR Product: FortiRecorder Product: FortiVoice Product: FortiWeb Category: Network devices

Description

Multiple stack-based buffer overflows in the command line interpreter of FortiWeb before 6.4.2 may allow an authenticated attacker to achieve arbitrary code execution via specially crafted commands.

Affected products

VendorProductAffectedFixed
Fortinet FortiFone 3.0.0 – ≤ 3.0.11 —
Fortinet FortiADC 7.0.0, 6.2.0 – ≤ 6.2.2, 6.1.0 – ≤ 6.1.6, 6.0.0 – ≤ 6.0.4, 5.4.0 – ≤ 5.4.5, 5.3.0 – ≤ 5.3.7, 5.2.0 – ≤ 5.2.8, 5.1.0 – ≤ 5.1.7, 5.0.0 – ≤ 5.0.4 —
Fortinet FortiMail 7.0.0 – ≤ 7.0.2, 6.4.0 – ≤ 6.4.6, 6.2.0 – ≤ 6.2.8, 6.0.0 – ≤ 6.0.12, 5.4.0 – ≤ 5.4.12 —
Fortinet FortiDDoS 5.7.0, 5.6.0 – ≤ 5.6.1, 5.5.0 – ≤ 5.5.1, 5.4.0 – ≤ 5.4.3, 5.3.0 – ≤ 5.3.2, 5.2.0, 5.1.0, 5.0.0, 4.7.0, 4.6.0, 4.5.0, 4.4.0 – ≤ 4.4.2 —
Fortinet FortiDDoS-F 6.3.0, 6.2.0 – ≤ 6.2.2, 6.1.0 – ≤ 6.1.4 —
Fortinet FortiVoice 6.4.0 – ≤ 6.4.4, 6.0.0 – ≤ 6.0.10 —
Fortinet FortiDDoS-CM 5.5.0 – ≤ 5.5.1, 5.4.0 – ≤ 5.4.3, 5.3.0 – ≤ 5.3.1, 5.2.0, 5.1.0, 5.0.0, 4.7.0 —
Fortinet FortiWeb 6.4.0 – ≤ 6.4.1, 6.3.0 – ≤ 6.3.15 —
Fortinet FortiRecorder 6.4.0 – ≤ 6.4.2, 6.0.0 – ≤ 6.0.10, 2.7.0 – ≤ 2.7.7, 2.6.0 – ≤ 2.6.3 —
Fortinet FortiNDR 1.5.0 – ≤ 1.5.3, 1.4.0, 1.3.0 – ≤ 1.3.1, 1.2.0, 1.1.0 —

References