CVE-2021-42756

—

CVSS 3.1

9.8 critical

EPSS

35%p98

Published

Feb 16, 2023 (Feb 16, 2023)

Modified

Jun 17, 2026

Description

Multiple stack-based buffer overflow vulnerabilities [CWE-121] in the proxy daemon of FortiWeb 5.x all versions, 6.0.7 and below, 6.1.2 and below, 6.2.6 and below, 6.3.16 and below, 6.4 all versions may allow an unauthenticated remote attacker to achieve arbitrary code execution via specifically crafted HTTP requests.

Vendors: fortinet
Products: fortiweb
Weakness: CWE-121, CWE-787
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (35.0%)

In the news6 stories

New Critical Flaw in FortiOS and FortiProxy Could Give Hackers Remote Access

The Hacker NewsMar 9, 05:23 UTC · Mar 9, 2023Exploit / PoC in the wildCVE-2023-25610 CVE-2022-39952 CVE-2021-42756

Fortinet FortiNAC CVE-2022-39952 flaw exploited in the wild hours after release of PoC exploit

Security AffairsFeb 23, 19:45 UTC · Feb 23, 2023Exploit / PoC in the wildCVE-2022-39952 CVE-2021-42756

Fortinet Issues Patches for 40 Flaws Affecting FortiWeb, FortiOS, FortiNAC, and FortiProxy

The Hacker NewsFeb 23, 03:50 UTC · Feb 23, 2023Vulnerability in the wildCVE-2022-39952 CVE-2021-42756

PoC exploit code for critical Fortinet FortiNAC bug released online

Security AffairsFeb 21, 21:05 UTC · Feb 21, 2023Exploit / PoC CVE-2022-39952 CVE-2021-427561

Fortinet plugs critical security hole in FortiNAC, with a PoC incoming (CVE-2022-39952)

Help Net SecurityFeb 20, 00:00 UTC · Feb 20, 2023Exploit / PoC in the wildCVE-2022-39952 CVE-2021-42756 CVE-2022-42475

Fortinet fixes critical vulnerabilities in FortiNAC and FortiWeb

Security AffairsFeb 17, 15:09 UTC · Feb 17, 2023Vulnerability CVE-2022-39952 CVE-2021-42756