CVE-2021-32589

HIGH

FortiAnalyzer and FortiManager - Use-After-Free via fgfm Port Request

Title source: llm
STIX 2.1

Description

A Use After Free (CWE-416) vulnerability in FortiManager version 7.0.0, version 6.4.5 and below, version 6.2.7 and below, version 6.0.10 and below, version 5.6.10 and below, version 5.4.7 and below, version 5.2.10 and below, version 5.0.12 and below and FortiAnalyzer version 7.0.0, version 6.4.5 and below, version 6.2.7 and below, version 6.0.10 and below, version 5.6.10 and below, version 5.4.7 and below, version 5.3.11, version 5.2.10 to 5.2.4 fgfmsd daemon may allow a remote, non-authenticated attacker to execute unauthorized code as root via sending a specifically crafted request to the fgfm port of the targeted device.

References (1)

Core 1
Core References

Scores

CVSS v3 8.1
EPSS 0.0867
EPSS Percentile 92.6%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact total

Details

CWE
CWE-416
Status published
Products (5)
fortinet/fortianalyzer 7.0.0
fortinet/fortianalyzer 5.2.4 - 5.6.11
fortinet/fortimanager 7.0.0
fortinet/fortimanager 5.0.0 - 5.6.11
fortinet/fortiportal 4.0.0 - 5.3.7
Published Dec 19, 2024
Tracked Since Feb 18, 2026