Skip to content
OpenAdvisories
Medium · 6.3 CVE-2021-42757 EUVD-2021-29715GHSA-8xwq-gmgr-vq48

A buffer overflow [CWE-121] in the TFTP client library of FortiOS before 6.4.7 and FortiOS 7.0.0 through 7.0.2, may allow an authenticated …

Published Dec 8, 2021 · Updated Oct 16, 2025 · Assigned by fortinet

Vendor: Fortinet Product: FortiADC Product: FortiAnalyzer Product: FortiDDoS Product: FortiDDoS-F Product: FortiMail Product: FortiManager Product: FortiNDR Product: FortiOS Product: FortiPortal Product: FortiProxy Product: FortiRecorder Product: FortiSwitch Product: FortiVoice Product: FortiWeb Category: Network devices

Description

A buffer overflow [CWE-121] in the TFTP client library of FortiOS before 6.4.7 and FortiOS 7.0.0 through 7.0.2, may allow an authenticated local attacker to achieve arbitrary code execution via specially crafted command line arguments.

Affected products

VendorProductAffectedFixed
Fortinet FortiOS 7.0.0 – ≤ 7.0.2, 6.4.0 – ≤ 6.4.7, 6.2.0 – ≤ 6.2.9, 6.0.0 – ≤ 6.0.13, 5.6.0 – ≤ 5.6.14, 5.4.0 – ≤ 5.4.13, 5.2.0 – ≤ 5.2.15, 5.0.0 – ≤ 5.0.14 —
Fortinet FortiDDoS-F 6.4.0 – ≤ 6.4.1, 6.3.0, 6.2.0 – ≤ 6.2.2, 6.1.0 – ≤ 6.1.4 —
Fortinet FortiVoice 6.4.0 – ≤ 6.4.4, 6.0.0 – ≤ 6.0.10 —
Fortinet FortiProxy 7.0.0 – ≤ 7.0.1, 2.0.0 – ≤ 2.0.7, 1.2.0 – ≤ 1.2.13, 1.1.0 – ≤ 1.1.6, 1.0.0 – ≤ 1.0.7 —
Fortinet FortiRecorder 6.4.0 – ≤ 6.4.2, 6.0.0 – ≤ 6.0.10, 2.7.0 – ≤ 2.7.7, 2.6.0 – ≤ 2.6.3 —
Fortinet FortiPortal 6.0.0 – ≤ 6.0.10, 5.3.0 – ≤ 5.3.8, 5.2.0 – ≤ 5.2.6, 5.1.0 – ≤ 5.1.2, 5.0.0 – ≤ 5.0.3 —
Fortinet FortiMail 7.0.0 – ≤ 7.0.2, 6.4.0 – ≤ 6.4.6, 6.2.0 – ≤ 6.2.7, 6.0.0 – ≤ 6.0.12, 5.4.0 – ≤ 5.4.12 —
Fortinet FortiAnalyzer 7.0.0 – ≤ 7.0.2, 6.4.0 – ≤ 6.4.7, 6.2.0 – ≤ 6.2.13, 6.0.0 – ≤ 6.0.12 —
Fortinet FortiNDR 1.5.0 – ≤ 1.5.2, 1.4.0, 1.3.0 – ≤ 1.3.1, 1.2.0, 1.1.0 —
Fortinet FortiDDoS 5.5.0 – ≤ 5.5.1, 5.4.0 – ≤ 5.4.3, 5.3.0 – ≤ 5.3.2, 5.2.0, 5.1.0, 5.0.0, 4.7.0, 4.6.0, 4.5.0, 4.4.0 – ≤ 4.4.2 —
Fortinet FortiSwitch 7.0.0 – ≤ 7.0.3, 6.4.0 – ≤ 6.4.9, 6.2.0 – ≤ 6.2.7, 6.0.0 – ≤ 6.0.7 —
Fortinet FortiADC 6.2.0 – ≤ 6.2.2, 6.1.0 – ≤ 6.1.5, 6.0.0 – ≤ 6.0.4, 5.4.0 – ≤ 5.4.5, 5.3.0 – ≤ 5.3.7, 5.2.0 – ≤ 5.2.8, 5.1.0 – ≤ 5.1.7, 5.0.0 – ≤ 5.0.4 —
Fortinet FortiWeb 6.4.0 – ≤ 6.4.1, 6.3.0 – ≤ 6.3.16, 6.2.0 – ≤ 6.2.8, 6.1.0 – ≤ 6.1.4, 6.0.0 – ≤ 6.0.8, 5.9.0 – ≤ 5.9.2, 5.8.5 – ≤ 5.8.7, 5.8.0 – ≤ 5.8.3, 5.7.0 – ≤ 5.7.3, 5.6.0 – ≤ 5.6.2, 5.5.0 – ≤ 5.5.7, 5.4.0 – ≤ 5.4.1, 5.3.0 – ≤ 5.3.9, 5.2.0 – ≤ 5.2.4, 5.1.0 – ≤ 5.1.4, 5.0.0 – ≤ 5.0.6 —
Fortinet FortiManager 7.0.0 – ≤ 7.0.2, 6.4.0 – ≤ 6.4.7, 6.2.0 – ≤ 6.2.13, 6.0.0 – ≤ 6.0.12 —

References