CVE-2021-44168: Fortinet FortiOS Arbitrary File Download
Fortinet FortiOS "execute restore src-vis" downloads code without integrity checking, allowing an attacker to arbitrarily download files.
Other sources
A download of code without integrity check vulnerability in the "execute restore src-vis" command of FortiOS before 7.0.3 may allow a local authenticated attacker to download arbitrary files on the device via specially crafted update packages.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Fortinet FortiOSto a version that resolves this vulnerability.Fixed in 7.0.3
Event History
Frequently Asked Questions
What is CVE-2021-44168?
CVE-2021-44168 is a vulnerability in Fortinet FortiOS that allows a local authenticated attacker to download arbitrary files on the device via specially crafted update packages.
How severe is CVE-2021-44168?
CVE-2021-44168 has a severity rating of 7.8 (high).
Which versions of FortiOS are affected by CVE-2021-44168?
FortiOS versions 6.0.0 to 6.0.14, 6.2.0 to 6.2.10, 6.4.0 to 6.4.8, and versions 7.0.0 to 7.0.3 are affected by CVE-2021-44168.
How can I mitigate CVE-2021-44168?
To mitigate CVE-2021-44168, upgrade FortiOS to version 7.0.3 or later.
Where can I find more information about CVE-2021-44168?
You can find more information about CVE-2021-44168 on the FortiGuard Advisory page: https://fortiguard.com/psirt/FG-IR-21-201.