CVE-2021-42755: Integer overflow in dhcpd daemon
An integer overflow / wraparound vulnerability [CWE-190] in FortiSwitch 7.0.2 and below, 6.4.9 and below, 6.2.x, 6.0.x; FortiRecorder 6.4.2 and below, 6.0.10 and below; FortiOS 7.0.2 and below, 6.4.8 and below, 6.2.10 and below, 6.0.x; FortiProxy 7.0.0, 2.0.6 and below, 1.2.x, 1.1.x, 1.0.x; FortiVoiceEnterprise 6.4.3 and below, 6.0.10 and below dhcpd daemon may allow an unauthenticated and network adjacent attacker to crash the dhcpd deamon, resulting in potential denial of service.
Other sources
An integer overflow / wraparound vulnerability [CWE-190] in the FortiOS, FortiProxy, FortiSwitch, FortiRecoder, and FortiVoiceEnterprisedhcpd daemon may allow an unauthenticated and network adjacent attacker to crash the dhcpd deamon, resulting in potential denial of service.
— FortiGuard
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2021-42755?
CVE-2021-42755 has been classified with a severity level of high due to the potential for remote code execution resulting from the integer overflow vulnerability.
How do I fix CVE-2021-42755?
To resolve CVE-2021-42755, it is recommended to upgrade your FortiSwitch, FortiRecorder, or FortiOS to the latest versions provided by Fortinet.
What systems are affected by CVE-2021-42755?
CVE-2021-42755 affects FortiSwitch versions 7.0.2 and below, FortiRecorder versions 6.4.2 and below, and multiple versions of FortiOS and FortiProxy.
Can CVE-2021-42755 be exploited remotely?
Yes, CVE-2021-42755 can be exploited remotely, allowing attackers to potentially execute arbitrary code on the affected devices.
What precautions should I take regarding CVE-2021-42755?
In addition to applying security updates, consider monitoring network traffic for unusual activities and ensuring proper firewall rules are in place to mitigate risks.