CVE-2021-42757 Memory corruption in FortiADC
An authenticated local attacker can achieve arbitrary code execution via a buffer overflow in the TFTP client library of FortiOS.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-42757?
CVE-2021-42757 is a medium-severity memory corruption vulnerability in Fortinet Fortianalyzer, published on 8 Dec 2021. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
A buffer overflow [CWE-121] in the TFTP client library of FortiOS before 6.4.7 and FortiOS 7.0.0 through 7.0.2, may allow an authenticated local attacker to achieve arbitrary code execution via specially crafted command line arguments.
Which versions are affected by CVE-2021-42757?
It affects 13 products.
Products include Fortinet Fortiadc, Fortinet Fortianalyzer, Fortinet Fortimail, Fortinet Fortimanager, Fortinet Fortindr, Fortinet Fortios and 7 more.
How do I fix CVE-2021-42757?
No fix has been published for CVE-2021-42757 yet. Limit exposure of the affected software until one is available.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2021-42757 being exploited?
There is no known exploitation of CVE-2021-42757 in the wild and no public exploit code.
Other vulnerabilities in Fortinet Fortianalyzer
Sources
Also known as GHSA-8xwq-gmgr-vq48.