CVE-2021-36173

{"id": "CVE-2021-36173", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 6.8, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}, {"type": "Secondary", "source": "psirt@fortinet.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.0, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.1}]}, "published": "2021-12-08T19:15:09.787", "references": [{"url": "https://fortiguard.com/advisory/FG-IR-21-115", "tags": ["Patch", "Vendor Advisory"], "source": "psirt@fortinet.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-787"}]}], "descriptions": [{"lang": "en", "value": "A heap-based buffer overflow in the firmware signature verification function of FortiOS versions 7.0.1, 7.0.0, 6.4.0 through 6.4.6, 6.2.0 through 6.2.9, and 6.0.0 through 6.0.13 may allow an attacker to execute arbitrary code via specially crafted installation images."}, {"lang": "es", "value": "Un desbordamiento de b\u00fafer en la regi\u00f3n heap de la memoria en la funci\u00f3n firmware signature verification de FortiOS versiones 7.0.1, 7.0.0, 6.4.0 hasta 6.4.6, 6.2.0 hasta 6.2.9 y 6.0.0 hasta 6.0.13, puede permitir a un atacante ejecutar c\u00f3digo arbitrario por medio de im\u00e1genes de instalaci\u00f3n especialmente dise\u00f1adas"}], "lastModified": "2021-12-10T16:37:23.297", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A6EF01D9-50FB-4300-87FB-132649A9AC51", "versionEndIncluding": "6.0.13", "versionStartIncluding": "6.0.0"}, {"criteria": "cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C4C0308D-8E52-456B-BFC2-62D4C1E9BDC3", "versionEndIncluding": "6.2.9", "versionStartIncluding": "6.2.0"}, {"criteria": "cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "88D6903E-70D0-4D63-BC68-BA37EE91BCB1", "versionEndIncluding": "6.4.6", "versionStartIncluding": "6.4.0"}, {"criteria": "cpe:2.3:o:fortinet:fortios:7.0.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "79FEE7F6-F72E-4A43-883C-0CF492DF355B"}, {"criteria": "cpe:2.3:o:fortinet:fortios:7.0.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FBDFDF02-2136-4DE0-A19B-FE3654ED90A4"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:fortinet:fortigate-1100e:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "58F428EE-70C1-440F-B16D-45D44A54FB9D"}, {"criteria": "cpe:2.3:h:fortinet:fortigate-200f:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "A07781B7-E990-4BF2-A828-441D556FF2DC"}, {"criteria": "cpe:2.3:h:fortinet:fortigate-2600f:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "4039DD9E-DAB4-45A4-90A7-50D345038CB9"}, {"criteria": "cpe:2.3:h:fortinet:fortigate-3500f:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "A1FD4947-6A13-4C8D-B22C-96D96ACB2363"}, {"criteria": "cpe:2.3:h:fortinet:fortigate-400e:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "FB3F963E-1CFE-4C7C-B44B-AF100592002E"}, {"criteria": "cpe:2.3:h:fortinet:fortigate-600e:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "F034C1C3-E8D1-4426-BC5E-A6D25E31B497"}, {"criteria": "cpe:2.3:h:fortinet:fortigate_1800f:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "76792D6F-B647-43A8-8A60-17BE35824BF7"}, {"criteria": "cpe:2.3:h:fortinet:fortigate_2200e:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "0B2A9D43-348B-45DB-94F7-825B29141F09"}, {"criteria": "cpe:2.3:h:fortinet:fortigate_3300e:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "0CCCA9CD-2B75-46AF-989C-C300CB53358E"}, {"criteria": "cpe:2.3:h:fortinet:fortigate_3600e:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "5015D2E8-8482-467A-96F4-65CBF0AFAC6E"}, {"criteria": "cpe:2.3:h:fortinet:fortigate_40f:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "96C31DB1-CEBD-4796-9CF1-5D9D000A5A9A"}, {"criteria": "cpe:2.3:h:fortinet:fortigate_60f:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "2D32F0C5-2949-48B6-B9DD-F070DE11C803"}, {"criteria": "cpe:2.3:h:fortinet:fortigate_7121f:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "E1663D59-D804-44A4-B768-93BDF60F8DEA"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "psirt@fortinet.com"}