low3.3Known exploited
CVE-2021-44168
Fortinet FortiOS Arbitrary File Download
Exploited in the wild
This vulnerability is on a Known Exploited Vulnerabilities catalogue, added 2021-12-10. Federal due date: 2021-12-24.
Apply updates per vendor instructions.
Impact
A download of code without integrity check vulnerability in the "execute restore src-vis" command of FortiOS before 7.0.3 may allow a local authenticated attacker to download arbitrary files on the device via specially crafted update packages.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Fortinet | Fortios | before 6.0.14 from 6.2.0 before 6.2.10 from 6.4.0 before 6.4.8 from 7.0.0 before 7.0.3 |