Multiple stack-based buffer overflows in the command line interpreter of FortiWeb before 6.4.2 may allow an authenticated attacker to achiev

Summary

Multiple stack-based buffer overflows in the command line interpreter of FortiWeb before 6.4.2 may allow an authenticated attacker to achieve arbitrary code execution via specially crafted commands.

Timeline

1. Feb 2, 2022, 11:19 AM UTCCVE published
2. Oct 23, 2024, 2:12 PM UTCCISA SSVC assessment

   Exploitation: none · Automatable: no · Technical impact: total

3. Jan 13, 2026, 4:32 PM UTCRecord last updated

Affected versions

• Fortinet FortiFone

  From 3.0.0 · through 3.0.11

• Fortinet FortiADC

  From 6.2.0 · through 6.2.2; From 6.1.0 · through 6.1.6; From 6.0.0 · through 6.0.4; From 5.4.0 · through 5.4.5; From 5.3.0 · through 5.3.7; From 5.2.0 · through 5.2.8; From 5.1.0 · through 5.1.7; From 5.0.0 · through 5.0.4

• Fortinet FortiMail

  From 7.0.0 · through 7.0.2; From 6.4.0 · through 6.4.6; From 6.2.0 · through 6.2.8; From 6.0.0 · through 6.0.12; From 5.4.0 · through 5.4.12

• Fortinet FortiDDoS

  From 5.6.0 · through 5.6.1; From 5.5.0 · through 5.5.1; From 5.4.0 · through 5.4.3; From 5.3.0 · through 5.3.2; From 4.4.0 · through 4.4.2

• Fortinet FortiDDoS-F

  From 6.2.0 · through 6.2.2; From 6.1.0 · through 6.1.4

• Fortinet FortiVoice

  From 6.4.0 · through 6.4.4; From 6.0.0 · through 6.0.10

• Fortinet FortiDDoS-CM

  From 5.5.0 · through 5.5.1; From 5.4.0 · through 5.4.3; From 5.3.0 · through 5.3.1

• Fortinet FortiWeb

  From 6.4.0 · through 6.4.1; From 6.3.0 · through 6.3.15

• Fortinet FortiRecorder

  From 6.4.0 · through 6.4.2; From 6.0.0 · through 6.0.10; From 2.7.0 · through 2.7.7; From 2.6.0 · through 2.6.3

• Fortinet FortiNDR

  From 1.5.0 · through 1.5.3; From 1.3.0 · through 1.3.1

References 1