Details of VAR-202202-1222

ID

VAR-202202-1222

CVE

CVE-2021-41016

TITLE

Fortinet FortiExtender In OS Command injection vulnerability

Trust: 0.8

sources: JVNDB: JVNDB-2022-004779

DESCRIPTION

A improper neutralization of special elements used in a command ('command injection') in Fortinet FortiExtender version 7.0.1 and below, 4.2.3 and below, 4.1.7 and below allows an authenticated attacker to execute privileged shell commands via CLI commands including special characters. Fortinet FortiExtender for, OS A command injection vulnerability exists.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. Fortinet FortiExtender is a wireless WAN (Wide Area Network) extender device from Fortinet

Trust: 2.16

sources: NVD: CVE-2021-41016 // JVNDB: JVNDB-2022-004779 // CNVD: CNVD-2022-19071

IOT TAXONOMY

category:

['Network device']

sub_category:

Trust: 0.6

sources: CNVD: CNVD-2022-19071

AFFECTED PRODUCTS

vendor:	fortinet	model:	fortiextender	scope:	gte	version:	4.1.1	Trust: 1.0
vendor:	fortinet	model:	fortiextender	scope:	lt	version:	4.2.4	Trust: 1.0
vendor:	fortinet	model:	fortiextender	scope:	gte	version:	7.0.0	Trust: 1.0
vendor:	fortinet	model:	fortiextender	scope:	lt	version:	4.1.8	Trust: 1.0
vendor:	fortinet	model:	fortiextender	scope:	gte	version:	4.2.0	Trust: 1.0
vendor:	fortinet	model:	fortiextender	scope:	lt	version:	7.0.2	Trust: 1.0
vendor:	フォーティネット	model:	fortiextender	scope:	lte	version:	fortiextender firmware 7.0.1 and earlier	Trust: 0.8
vendor:	フォーティネット	model:	fortiextender	scope:	eq	version:	-	Trust: 0.8
vendor:	フォーティネット	model:	fortiextender	scope:	lte	version:	fortiextender firmware 4.1.7 and earlier	Trust: 0.8
vendor:	フォーティネット	model:	fortiextender	scope:	lte	version:	fortiextender firmware 4.2.3 and earlier	Trust: 0.8
vendor:	fortinet	model:	fortiextender	scope:	lte	version:	<=7.0.1	Trust: 0.6
vendor:	fortinet	model:	fortiextender	scope:	lte	version:	<=4.2.3	Trust: 0.6
vendor:	fortinet	model:	fortiextender	scope:	lte	version:	<=4.1.7	Trust: 0.6

sources: CNVD: CNVD-2022-19071 // JVNDB: JVNDB-2022-004779 // NVD: CVE-2021-41016

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2021-41016
value:	HIGH
Trust: 1.0
psirt@fortinet.com:	CVE-2021-41016
value:	HIGH
Trust: 1.0
NVD:	CVE-2021-41016
value:	HIGH
Trust: 0.8
CNVD:	CNVD-2022-19071
value:	HIGH
Trust: 0.6
CNNVD:	CNNVD-202202-126
value:	HIGH
Trust: 0.6

nvd@nist.gov:	CVE-2021-41016
severity:	HIGH
baseScore:	9.0
vectorString:	AV:N/AC:L/AU:S/C:C/I:C/A:C
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	SINGLE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	8.0
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.8
CNVD:	CNVD-2022-19071
severity:	HIGH
baseScore:	9.0
vectorString:	AV:N/AC:L/AU:S/C:C/I:C/A:C
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	SINGLE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	8.0
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.6

nvd@nist.gov:	CVE-2021-41016
baseSeverity:	HIGH
baseScore:	8.8
vectorString:	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	LOW
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	2.8
impactScore:	5.9
version:	3.1
Trust: 1.0
psirt@fortinet.com:	CVE-2021-41016
baseSeverity:	HIGH
baseScore:	7.8
vectorString:	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector:	LOCAL
attackComplexity:	LOW
privilegesRequired:	LOW
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	1.8
impactScore:	5.9
version:	3.1
Trust: 1.0
NVD:	CVE-2021-41016
baseSeverity:	HIGH
baseScore:	8.8
vectorString:	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	LOW
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	NONE
impactScore:	NONE
version:	3.0
Trust: 0.8

sources: CNVD: CNVD-2022-19071 // JVNDB: JVNDB-2022-004779 // CNNVD: CNNVD-202202-126 // NVD: CVE-2021-41016 // NVD: CVE-2021-41016

PROBLEMTYPE DATA

problemtype:	CWE-78	Trust: 1.0
problemtype:	OS Command injection (CWE-78) [NVD evaluation ]	Trust: 0.8

sources: JVNDB: JVNDB-2022-004779 // NVD: CVE-2021-41016

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-202202-126

TYPE

operating system commend injection

Trust: 0.6

sources: CNNVD: CNNVD-202202-126

PATCH

title:	FG-IR-21-148	url:	https://www.fortiguard.com/psirt/FG-IR-21-148	Trust: 0.8
title:	Patch for Fortinet FortiExtender Command Injection Vulnerability	url:	https://www.cnvd.org.cn/patchInfo/show/325276	Trust: 0.6
title:	Fortinet FortiExtender Fixes for command injection vulnerabilities	url:	http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=180908	Trust: 0.6

sources: CNVD: CNVD-2022-19071 // JVNDB: JVNDB-2022-004779 // CNNVD: CNNVD-202202-126

EXTERNAL IDS

db:	NVD	id:	CVE-2021-41016	Trust: 3.8
db:	JVNDB	id:	JVNDB-2022-004779	Trust: 0.8
db:	CNVD	id:	CNVD-2022-19071	Trust: 0.6
db:	CNNVD	id:	CNNVD-202202-126	Trust: 0.6

sources: CNVD: CNVD-2022-19071 // JVNDB: JVNDB-2022-004779 // CNNVD: CNNVD-202202-126 // NVD: CVE-2021-41016

REFERENCES

url:	https://fortiguard.com/advisory/fg-ir-21-148	Trust: 2.2
url:	https://nvd.nist.gov/vuln/detail/cve-2021-41016	Trust: 1.4

sources: CNVD: CNVD-2022-19071 // JVNDB: JVNDB-2022-004779 // CNNVD: CNNVD-202202-126 // NVD: CVE-2021-41016

SOURCES

db:	CNVD	id:	CNVD-2022-19071
db:	JVNDB	id:	JVNDB-2022-004779
db:	CNNVD	id:	CNNVD-202202-126
db:	NVD	id:	CVE-2021-41016

LAST UPDATE DATE

2024-11-23T21:33:10.691000+00:00

SOURCES UPDATE DATE

db:	CNVD	id:	CNVD-2022-19071	date:	2022-03-14T00:00:00
db:	JVNDB	id:	JVNDB-2022-004779	date:	2023-05-01T08:38:00
db:	CNNVD	id:	CNNVD-202202-126	date:	2022-07-14T00:00:00
db:	NVD	id:	CVE-2021-41016	date:	2024-11-21T06:25:16.133

SOURCES RELEASE DATE

db:	CNVD	id:	CNVD-2022-19071	date:	2022-03-14T00:00:00
db:	JVNDB	id:	JVNDB-2022-004779	date:	2023-05-01T00:00:00
db:	CNNVD	id:	CNNVD-202202-126	date:	2022-02-02T00:00:00
db:	NVD	id:	CVE-2021-41016	date:	2022-02-02T11:15:07.777