CVE-2021-22127: OS Command Injection

Q: What is the vulnerability ID of this FortiClient vulnerability?

The vulnerability ID is CVE-2021-22127.

Q: What is the severity level of CVE-2021-22127?

The severity level of CVE-2021-22127 is high.

Q: How does CVE-2021-22127 affect FortiClient for Linux?

CVE-2021-22127 affects FortiClient for Linux versions 6.4.x before 6.4.3 and 6.2.x before 6.2.9.

Q: What is the impact of CVE-2021-22127?

CVE-2021-22127 allows an unauthenticated attacker to execute arbitrary code on the host operating system as root by tricking the user into connecting to a network with a malicious na.

Q: Is there a fix available for CVE-2021-22127?

Yes, a fix is available. Users should update FortiClient for Linux to version 6.4.3 or later.

Published Apr 6, 2022

Updated

An improper input validation vulnerability in FortiClient for Linux 6.4.x before 6.4.3, FortiClient for Linux 6.2.x before 6.2.9 may allow an unauthenticated attacker to execute arbitrary code on the host operating system as root via tricking the user into connecting to a network with a malicious name.

Affected Software

2 affected components

Fortinet FortiClient Linux<6.2.9

Fortinet FortiClient Linux>=6.4.0<6.4.3

Event History

Apr 6, 2022

CVE Published

via MITRE·04:00 PM

Data Sourced

via MITRE·04:00 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the vulnerability ID of this FortiClient vulnerability?

The vulnerability ID is CVE-2021-22127.

What is the severity level of CVE-2021-22127?

The severity level of CVE-2021-22127 is high.

How does CVE-2021-22127 affect FortiClient for Linux?

CVE-2021-22127 affects FortiClient for Linux versions 6.4.x before 6.4.3 and 6.2.x before 6.2.9.

What is the impact of CVE-2021-22127?

CVE-2021-22127 allows an unauthenticated attacker to execute arbitrary code on the host operating system as root by tricking the user into connecting to a network with a malicious na.

Is there a fix available for CVE-2021-22127?