SOC status:Duty analyst on shift

UK Cyber Defence
VulnerabilityModified

CVE-2021-42756

Multiple stack-based buffer overflow vulnerabilities [CWE-121] in the proxy daemon of FortiWeb 5.x all versions, 6.0.7 and below, 6.1.2 and below, 6.2.6 and below, 6.3.16 and below, 6.4 all versions may allow an unauthenticated remote attacker to…

CRITICAL 9.8EPSS 35.0%

Does this matter?

EPSS puts the probability of exploitation in the next 30 days at 35.0%, higher than 98% of all known CVEs. Patch or mitigate before the next change window.

Description

Multiple stack-based buffer overflow vulnerabilities [CWE-121] in the proxy daemon of FortiWeb 5.x all versions, 6.0.7 and below, 6.1.2 and below, 6.2.6 and below, 6.3.16 and below, 6.4 all versions may allow an unauthenticated remote attacker to achieve arbitrary code execution via specifically crafted HTTP requests.

CVSS 3.1
9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS
34.98% probability · 98th percentile
CISA KEV
Not listed
Weakness
CWE-121, CWE-787
Affected
fortinet/fortiweb
Source
psirt@fortinet.com

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.