CVE-2021-41021 Privilege escalation in Fortinet FortiNAC

High 7.8 Published 8 Dec 2021 Updated 25 Oct 2024

An admin user can escalate privileges to root via the sudo command in FortiNAC, requiring an upgrade to mitigate.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: Not needed
Fix: None listed

What is CVE-2021-41021?

CVE-2021-41021 is a high-severity vulnerability in Fortinet FortiNAC, published on 8 Dec 2021. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

A privilege escalation vulnerability in FortiNAC versions 8.8.8 and below and 9.1.2 and below may allow an admin user to escalate the privileges to root via the sudo command.

Which versions are affected by CVE-2021-41021?

It affects 1 product.

Products include Fortinet Fortinac.

How do I fix CVE-2021-41021?

No fix has been published for CVE-2021-41021 yet. Limit exposure of the affected software until one is available.

Is CVE-2021-41021 being exploited?

There is no known exploitation of CVE-2021-41021 in the wild and no public exploit code.

Sources

Also known as GHSA-9983-gjwx-g47w.