CVE-2021-43066
First published: Wed May 11 2022(Updated: )
A external control of file name or path in Fortinet FortiClientWindows version 7.0.2 and below, version 6.4.6 and below, version 6.2.9 and below, version 6.0.10 and below allows attacker to escalate privilege via the MSI installer.
Credit: psirt@fortinet.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Fortinet FortiClient Windows | >=6.0.0<6.4.7 | |
| Fortinet FortiClient Windows | >=7.0.0<7.0.3 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2021-43066?
CVE-2021-43066 is a vulnerability that allows an attacker to escalate privilege in Fortinet FortiClientWindows versions 7.0.2 and below, 6.4.6 and below, 6.2.9 and below, and 6.0.10 and below via the MSI installer.
How severe is CVE-2021-43066?
CVE-2021-43066 has a severity value of 7.8, which is considered high.
How does CVE-2021-43066 affect Fortinet FortiClientWindows?
CVE-2021-43066 affects Fortinet FortiClientWindows versions 7.0.2 and below, 6.4.6 and below, 6.2.9 and below, and 6.0.10 and below.
How can an attacker exploit CVE-2021-43066?
An attacker can exploit CVE-2021-43066 by controlling the file name or path in the MSI installer.
Is there a fix available for CVE-2021-43066?
To fix CVE-2021-43066, update Fortinet FortiClientWindows to version 6.4.7 or above for versions 6.x, and version 7.0.3 or above for version 7.x.
- collector/nvd-index
- agent/severity
- agent/weakness
- agent/references
- agent/author
- agent/tags
- agent/event
- agent/type
- agent/description
- agent/last-modified-date
- agent/softwarecombine
- agent/first-publish-date
- collector/mitre-cve
- source/MITRE
- vendor/fortinet
- canonical/fortinet forticlient windows
- version/fortinet forticlient windows/6.0.0
- version/fortinet forticlient windows/7.0.0