CVE-2021-42756

CVSS 3.1: 9.8 critical
EPSS: 35%p98
Published: Feb 16, 2023 · Feb 16, 2023
Modified: Jun 17, 2026

Analyze CVE-2021-42756 with Vani AIImpact, affected versions, exploitation status, mitigations and detection

Description · NVD

Multiple stack-based buffer overflow vulnerabilities [CWE-121] in the proxy daemon of FortiWeb 5.x all versions, 6.0.7 and below, 6.1.2 and below, 6.2.6 and below, 6.3.16 and below, 6.4 all versions may allow an unauthenticated remote attacker to achieve arbitrary code execution via specifically crafted HTTP requests.

Vendors: fortinet

Products: fortiweb

Weakness: CWE-121, CWE-787

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (35.0%)

In the news

6 stories

New Critical Flaw in FortiOS and FortiProxy Could Give Hackers Remote Access

The Hacker NewsMar 9, 05:23 UTC · Mar 9, 2023Exploit / PoCExploitedCVE-2023-25610 CVE-2022-39952 CVE-2021-427561

Fortinet FortiNAC CVE-2022-39952 flaw exploited in the wild hours after release of PoC exploit

Security AffairsFeb 23, 19:45 UTC · Feb 23, 2023Exploit / PoCExploitedCVE-2022-39952 CVE-2021-427562

Fortinet Issues Patches for 40 Flaws Affecting FortiWeb, FortiOS, FortiNAC, and FortiProxy

The Hacker NewsFeb 23, 03:50 UTC · Feb 23, 2023VulnerabilityExploitedCVE-2022-39952 CVE-2021-427562 · 1 read

PoC exploit code for critical Fortinet FortiNAC bug released online

Security AffairsFeb 21, 21:05 UTC · Feb 21, 2023Exploit / PoCCVE-2022-39952 CVE-2021-427564

Fortinet plugs critical security hole in FortiNAC, with a PoC incoming (CVE-2022-39952)

Help Net SecurityFeb 20, 00:00 UTC · Feb 20, 2023Exploit / PoCExploitedCVE-2022-39952 CVE-2021-42756 CVE-2022-424752 · 1 read

Fortinet fixes critical vulnerabilities in FortiNAC and FortiWeb

Security AffairsFeb 17, 15:09 UTC · Feb 17, 2023VulnerabilityCVE-2022-39952 CVE-2021-427562 · 1 read