← CVE Radar
CVE-2021-44168Fortinet FortiOS Arbitrary File Download
A download of code without integrity check vulnerability in the "execute restore src-vis" command of FortiOS before 7.0.3 may allow a local authenticated attacker to download arbitrary files on the device via specially crafted update packages.
7.8 HIGHEPSS 0.90%⚡ Known Exploited (CISA KEV)NVD: Analyzed
Overview
Severity
| Score | Severity | Version | Vector String |
|---|---|---|---|
| 7.8 | HIGH | 3.1NVD | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| 3.3 | LOW | 3.1fortinet (CNA) | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N |
| 3.3 | LOW | 3.1fortinet (CNA) | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N/E:P/RL:U/RC:C |
| 4.6 | MEDIUM | 2.0NVD | AV:L/AC:L/Au:N/C:P/I:P/A:P |
CISA required action
⚡ Known exploited · remediation due Dec 24, 2021
Apply updates per vendor instructions.
Details
- CVE ID
- CVE-2021-44168
- Status
- Analyzed
- Assigner (CNA)
- fortinet
- Published
- Jan 4, 2022
- Last modified
- 2026-06-17 04:11 UTC
- Weaknesses
Affected Products
As published by the CNA in the CVE record.
FortinetFortinet FortiOS1 version range
- FortiOS before 7.0.3