CVE-2021-41016: Arbitrary command execution because of missing CLI input sanitization
A improper neutralization of special elements used in a command ('command injection') in Fortinet FortiExtender version 7.0.1 and below, 4.2.3 and below, 4.1.7 and below allows an authenticated attacker to execute privileged shell commands via CLI commands including special characters
Other sources
An improper neutralization of special elements used in a command vulnerability ('Command Injection') [CWE-77] in FortiExtender may allow an authenticated user to raise its privileges to admin user via crafted arguments of the execute CLI command.
— FortiGuard
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2021-41016?
CVE-2021-41016 has been classified as a critical severity vulnerability due to its potential to allow unauthorized command execution.
How do I fix CVE-2021-41016?
To mitigate CVE-2021-41016, upgrade Fortinet FortiExtender firmware to version 4.1.8 or later, 4.2.4 or later, or 7.0.2 or later.
Who is affected by CVE-2021-41016?
CVE-2021-41016 affects users running Fortinet FortiExtender firmware versions 7.0.1 and below, 4.2.3 and below, or 4.1.7 and below.
What type of attack does CVE-2021-41016 allow?
CVE-2021-41016 allows authenticated attackers to execute privileged shell commands through command injection.
Is CVE-2021-41016 a local or remote vulnerability?
CVE-2021-41016 is a local vulnerability, as it requires authentication to exploit.