Multiple stack-based buffer overflows in the command line interpreter of FortiWeb before 6.4.2 may allow an authenticated attacker to achieve arbitrary code execution via specially crafted commands.
Advisories
Source ID Title
EUVD EUVD EUVD-2021-22814 Multiple stack-based buffer overflows in the command line interpreter of FortiWeb before 6.4.2 may allow an authenticated attacker to achieve arbitrary code execution via specially crafted commands.
Fixes

Solution

Please upgrade to FortiFone version 3.0.12 or above Please upgrade to FortiWeb version 7.0.0 or above Please upgrade to FortiWeb version 6.4.2 or above Please upgrade to FortiWeb version 6.3.17 or above Please upgrade to FortiWeb version 6.3.16 or above Please upgrade to FortiWeb version 6.2.7 or above Please upgrade to FortiRecorder version 7.0.0 or above Please upgrade to FortiRecorder version 6.4.3 or above Please upgrade to FortiRecorder version 6.0.11 or above Please upgrade to FortiVoiceEnterprise version 6.4.5 or above Please upgrade to FortiVoiceEnterprise version 6.0.11 or above Please upgrade to FortiMail version 7.2.0 or above Please upgrade to FortiMail version 7.0.3 or above Please upgrade to FortiMail version 6.4.7 or above Please upgrade to FortiMail version 6.2.9 or above Please upgrade to FortiDDoS-F version 6.3.1 or above Please upgrade to FortiDDoS-F version 6.2.3 or above Please upgrade to FortiDDoS-F version 6.1.5 or above Please upgrade to FortiADC version 7.0.1 or above Please upgrade to FortiADC version 6.2.3 or above Please upgrade to FortiADC version 6.1.7 or above Please upgrade to FortiNDR version 7.0.0 or above Please upgrade to FortiDDoS version 5.7.1 or above Please upgrade to FortiDDoS version 5.6.2 or above Please upgrade to FortiDDoS version 5.5.2 or above Please upgrade to FortiDDoS version 5.4.3 or above Please upgrade to FortiDDoS version 5.3.2 or above Please upgrade to FortiDDoS-CM version 5.7.1 or above Please upgrade to FortiDDoS-CM version 5.6.2 or above Please upgrade to FortiDDoS-CM version 5.5.2 or above Please upgrade to FortiDDoS-CM version 5.4.3 or above Please upgrade to FortiDDoS-CM version 5.3.2 or above


Workaround

No workaround given by the vendor.

History

Tue, 13 Jan 2026 16:45:00 +0000

Type Values Removed Values Added
Description Multiple stack-based buffer overflows in the command line interpreter of FortiWeb before 6.4.2 may allow an authenticated attacker to achieve arbitrary code execution via specially crafted commands. Multiple stack-based buffer overflows in the command line interpreter of FortiWeb before 6.4.2 may allow an authenticated attacker to achieve arbitrary code execution via specially crafted commands.
First Time appeared Fortinet fortiadc
Fortinet fortiddos
Fortinet fortiddos-f
Fortinet fortimail
Fortinet fortindr
Fortinet fortirecorder
Fortinet fortivoice
Weaknesses CWE-121
CPEs cpe:2.3:a:fortinet:fortimail:5.4.0:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortimail:5.4.10:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortimail:5.4.11:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortimail:5.4.12:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortimail:5.4.1:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortimail:5.4.2:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortimail:5.4.3:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortimail:5.4.4:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortimail:5.4.5:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortimail:5.4.6:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortimail:5.4.7:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortimail:5.4.8:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortimail:5.4.9:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortimail:6.0.0:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortimail:6.0.10:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortimail:6.0.11:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortimail:6.0.12:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortimail:6.0.1:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortimail:6.0.2:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortimail:6.0.3:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortimail:6.0.4:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortimail:6.0.5:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortimail:6.0.6:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortimail:6.0.7:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortimail:6.0.8:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortimail:6.0.9:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortimail:6.2.0:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortimail:6.2.1:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortimail:6.2.2:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortimail:6.2.3:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortimail:6.2.4:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortimail:6.2.5:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortimail:6.2.6:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortimail:6.2.7:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortimail:6.2.8:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortimail:6.4.0:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortimail:6.4.1:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortimail:6.4.2:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortimail:6.4.3:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortimail:6.4.4:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortimail:6.4.5:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortimail:6.4.6:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortimail:7.0.0:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortimail:7.0.1:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortimail:7.0.2:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortindr:1.1.0:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortindr:1.2.0:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortindr:1.3.0:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortindr:1.3.1:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortindr:1.4.0:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortindr:1.5.0:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortindr:1.5.1:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortindr:1.5.2:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortindr:1.5.3:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortirecorder:2.6.0:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortirecorder:2.6.1:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortirecorder:2.6.2:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortirecorder:2.6.3:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortirecorder:2.7.0:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortirecorder:2.7.1:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortirecorder:2.7.2:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortirecorder:2.7.3:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortirecorder:2.7.4:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortirecorder:2.7.5:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortirecorder:2.7.6:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortirecorder:2.7.7:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortirecorder:6.0.0:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortirecorder:6.0.10:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortirecorder:6.0.1:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortirecorder:6.0.2:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortirecorder:6.0.3:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortirecorder:6.0.4:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortirecorder:6.0.5:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortirecorder:6.0.6:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortirecorder:6.0.7:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortirecorder:6.0.8:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortirecorder:6.0.9:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortirecorder:6.4.0:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortirecorder:6.4.1:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortirecorder:6.4.2:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortivoice:6.0.0:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortivoice:6.0.10:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortivoice:6.0.1:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortivoice:6.0.2:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortivoice:6.0.3:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortivoice:6.0.4:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortivoice:6.0.5:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortivoice:6.0.6:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortivoice:6.0.7:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortivoice:6.0.8:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortivoice:6.0.9:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortivoice:6.4.0:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortivoice:6.4.1:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortivoice:6.4.2:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortivoice:6.4.3:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortivoice:6.4.4:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiweb:6.3.0:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiweb:6.3.10:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiweb:6.3.11:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiweb:6.3.12:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiweb:6.3.13:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiweb:6.3.14:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiweb:6.3.15:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiweb:6.3.1:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiweb:6.3.2:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiweb:6.3.3:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiweb:6.3.4:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiweb:6.3.5:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiweb:6.3.6:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiweb:6.3.7:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiweb:6.3.8:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiweb:6.3.9:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiweb:6.4.0:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiweb:6.4.1:*:*:*:*:*:*:*
cpe:2.3:h:fortinet:fortiadc:5.0.0:*:*:*:*:*:*:*
cpe:2.3:h:fortinet:fortiadc:5.0.1:*:*:*:*:*:*:*
cpe:2.3:h:fortinet:fortiadc:5.0.2:*:*:*:*:*:*:*
cpe:2.3:h:fortinet:fortiadc:5.0.3:*:*:*:*:*:*:*
cpe:2.3:h:fortinet:fortiadc:5.0.4:*:*:*:*:*:*:*
cpe:2.3:h:fortinet:fortiadc:5.1.0:*:*:*:*:*:*:*
cpe:2.3:h:fortinet:fortiadc:5.1.1:*:*:*:*:*:*:*
cpe:2.3:h:fortinet:fortiadc:5.1.2:*:*:*:*:*:*:*
cpe:2.3:h:fortinet:fortiadc:5.1.3:*:*:*:*:*:*:*
cpe:2.3:h:fortinet:fortiadc:5.1.4:*:*:*:*:*:*:*
cpe:2.3:h:fortinet:fortiadc:5.1.5:*:*:*:*:*:*:*
cpe:2.3:h:fortinet:fortiadc:5.1.6:*:*:*:*:*:*:*
cpe:2.3:h:fortinet:fortiadc:5.1.7:*:*:*:*:*:*:*
cpe:2.3:h:fortinet:fortiadc:5.2.0:*:*:*:*:*:*:*
cpe:2.3:h:fortinet:fortiadc:5.2.1:*:*:*:*:*:*:*
cpe:2.3:h:fortinet:fortiadc:5.2.2:*:*:*:*:*:*:*
cpe:2.3:h:fortinet:fortiadc:5.2.3:*:*:*:*:*:*:*
cpe:2.3:h:fortinet:fortiadc:5.2.4:*:*:*:*:*:*:*
cpe:2.3:h:fortinet:fortiadc:5.2.5:*:*:*:*:*:*:*
cpe:2.3:h:fortinet:fortiadc:5.2.6:*:*:*:*:*:*:*
cpe:2.3:h:fortinet:fortiadc:5.2.7:*:*:*:*:*:*:*
cpe:2.3:h:fortinet:fortiadc:5.2.8:*:*:*:*:*:*:*
cpe:2.3:h:fortinet:fortiadc:5.3.0:*:*:*:*:*:*:*
cpe:2.3:h:fortinet:fortiadc:5.3.1:*:*:*:*:*:*:*
cpe:2.3:h:fortinet:fortiadc:5.3.2:*:*:*:*:*:*:*
cpe:2.3:h:fortinet:fortiadc:5.3.3:*:*:*:*:*:*:*
cpe:2.3:h:fortinet:fortiadc:5.3.4:*:*:*:*:*:*:*
cpe:2.3:h:fortinet:fortiadc:5.3.5:*:*:*:*:*:*:*
cpe:2.3:h:fortinet:fortiadc:5.3.6:*:*:*:*:*:*:*
cpe:2.3:h:fortinet:fortiadc:5.3.7:*:*:*:*:*:*:*
cpe:2.3:h:fortinet:fortiadc:5.4.0:*:*:*:*:*:*:*
cpe:2.3:h:fortinet:fortiadc:5.4.1:*:*:*:*:*:*:*
cpe:2.3:h:fortinet:fortiadc:5.4.2:*:*:*:*:*:*:*
cpe:2.3:h:fortinet:fortiadc:5.4.3:*:*:*:*:*:*:*
cpe:2.3:h:fortinet:fortiadc:5.4.4:*:*:*:*:*:*:*
cpe:2.3:h:fortinet:fortiadc:5.4.5:*:*:*:*:*:*:*
cpe:2.3:h:fortinet:fortiadc:6.0.0:*:*:*:*:*:*:*
cpe:2.3:h:fortinet:fortiadc:6.0.1:*:*:*:*:*:*:*
cpe:2.3:h:fortinet:fortiadc:6.0.2:*:*:*:*:*:*:*
cpe:2.3:h:fortinet:fortiadc:6.0.3:*:*:*:*:*:*:*
cpe:2.3:h:fortinet:fortiadc:6.0.4:*:*:*:*:*:*:*
cpe:2.3:h:fortinet:fortiadc:6.1.0:*:*:*:*:*:*:*
cpe:2.3:h:fortinet:fortiadc:6.1.1:*:*:*:*:*:*:*
cpe:2.3:h:fortinet:fortiadc:6.1.2:*:*:*:*:*:*:*
cpe:2.3:h:fortinet:fortiadc:6.1.3:*:*:*:*:*:*:*
cpe:2.3:h:fortinet:fortiadc:6.1.4:*:*:*:*:*:*:*
cpe:2.3:h:fortinet:fortiadc:6.1.5:*:*:*:*:*:*:*
cpe:2.3:h:fortinet:fortiadc:6.1.6:*:*:*:*:*:*:*
cpe:2.3:h:fortinet:fortiadc:6.2.0:*:*:*:*:*:*:*
cpe:2.3:h:fortinet:fortiadc:6.2.1:*:*:*:*:*:*:*
cpe:2.3:h:fortinet:fortiadc:6.2.2:*:*:*:*:*:*:*
cpe:2.3:h:fortinet:fortiadc:7.0.0:*:*:*:*:*:*:*
cpe:2.3:o:fortinet:fortiddos-f:6.1.0:*:*:*:*:*:*:*
cpe:2.3:o:fortinet:fortiddos-f:6.1.1:*:*:*:*:*:*:*
cpe:2.3:o:fortinet:fortiddos-f:6.1.2:*:*:*:*:*:*:*
cpe:2.3:o:fortinet:fortiddos-f:6.1.3:*:*:*:*:*:*:*
cpe:2.3:o:fortinet:fortiddos-f:6.1.4:*:*:*:*:*:*:*
cpe:2.3:o:fortinet:fortiddos-f:6.2.0:*:*:*:*:*:*:*
cpe:2.3:o:fortinet:fortiddos-f:6.2.1:*:*:*:*:*:*:*
cpe:2.3:o:fortinet:fortiddos-f:6.2.2:*:*:*:*:*:*:*
cpe:2.3:o:fortinet:fortiddos-f:6.3.0:*:*:*:*:*:*:*
cpe:2.3:o:fortinet:fortiddos:4.4.0:*:*:*:*:*:*:*
cpe:2.3:o:fortinet:fortiddos:4.4.1:*:*:*:*:*:*:*
cpe:2.3:o:fortinet:fortiddos:4.4.2:*:*:*:*:*:*:*
cpe:2.3:o:fortinet:fortiddos:4.5.0:*:*:*:*:*:*:*
cpe:2.3:o:fortinet:fortiddos:4.6.0:*:*:*:*:*:*:*
cpe:2.3:o:fortinet:fortiddos:4.7.0:*:*:*:*:*:*:*
cpe:2.3:o:fortinet:fortiddos:5.0.0:*:*:*:*:*:*:*
cpe:2.3:o:fortinet:fortiddos:5.1.0:*:*:*:*:*:*:*
cpe:2.3:o:fortinet:fortiddos:5.2.0:*:*:*:*:*:*:*
cpe:2.3:o:fortinet:fortiddos:5.3.0:*:*:*:*:*:*:*
cpe:2.3:o:fortinet:fortiddos:5.3.1:*:*:*:*:*:*:*
cpe:2.3:o:fortinet:fortiddos:5.3.2:*:*:*:*:*:*:*
cpe:2.3:o:fortinet:fortiddos:5.4.0:*:*:*:*:*:*:*
cpe:2.3:o:fortinet:fortiddos:5.4.1:*:*:*:*:*:*:*
cpe:2.3:o:fortinet:fortiddos:5.4.2:*:*:*:*:*:*:*
cpe:2.3:o:fortinet:fortiddos:5.4.3:*:*:*:*:*:*:*
cpe:2.3:o:fortinet:fortiddos:5.5.0:*:*:*:*:*:*:*
cpe:2.3:o:fortinet:fortiddos:5.5.1:*:*:*:*:*:*:*
cpe:2.3:o:fortinet:fortiddos:5.6.0:*:*:*:*:*:*:*
cpe:2.3:o:fortinet:fortiddos:5.6.1:*:*:*:*:*:*:*
cpe:2.3:o:fortinet:fortiddos:5.7.0:*:*:*:*:*:*:*
Vendors & Products Fortinet fortiadc
Fortinet fortiddos
Fortinet fortiddos-f
Fortinet fortimail
Fortinet fortindr
Fortinet fortirecorder
Fortinet fortivoice
Metrics cvssV3_1

{'score': 6.7, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:U/RC:C'}

cvssV3_1

{'score': 6.3, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:U/RC:C'}


Fri, 25 Oct 2024 14:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}


Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: fortinet

Published:

Updated: 2026-01-13T16:32:40.255Z

Reserved: 2021-07-06T00:00:00

Link: CVE-2021-36193

cve-icon Vulnrichment

Updated: 2024-08-04T00:54:50.136Z

cve-icon NVD

Status : Modified

Published: 2022-02-02T12:15:07.977

Modified: 2026-01-13T17:15:55.737

Link: CVE-2021-36193

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses