Privilege escalation in Fortinet Fortiadc
CVE-2021-43076
An improper privilege management vulnerability [CWE-269] in FortiADC versions 6.2.1 and below, 6.1.5 and below, 6.0.4 and below, 5.4.5 and below and 5.3.7 and below may allow a remote authenticated attacker with restricted user profile to modify the system files using the shell access.
Vulnerability class: Privilege Escalation
EPSS: 0.005 (37.5th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 6.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L.
Affected products
- Fortinet Fortiadc — versions FortiADC 6.2.1, 6.2.0, 6.1.5, 6.1.4, 6.1.3, 6.1.2, 6.1.1, 6.1.0, 6.0.4, 6.0.3, 6.0.2, 6.0.1, 6.0.0, 5.4.5, 5.4.4, 5.4.3, 5.4.2, 5.4.1, 5.4.0, 5.3.7, 5.3.6, 5.3.5, 5.3.4, 5.3.3, 5.3.2, 5.3.1, 5.3.0, 6.2.1, 6.2.0
Weakness classification (CWE)
References
- psirt@fortinet.com (x_refsource_CONFIRM, Vendor Advisory)
Frequently asked questions
- What is CVE-2021-43076?
- CVE-2021-43076 is a medium-severity vulnerability in Fortinet Fortiadc, classified under Improper Privilege Management. CVSS score: 6.3/10. Published 2022-09-06.
- How severe is CVE-2021-43076?
- Medium severity. CVSS v3 base score is 6.3 out of 10.