CVE-2021-44168
Fortinet FortiOS Arbitrary File Download
Description
CVE-2021-44168 is a vulnerability in Fortinet FortiOS that involves downloading code without an integrity check. The "execute restore src-vis" command in FortiOS before version 7.0.3 allows a local authenticated attacker to download arbitrary files on the device via specially crafted update packages. This download of code without integrity check vulnerability means that the FortiOS system does not verify the authenticity or integrity of downloaded content before processing it. CISA has added CVE-2021-44168 to its Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. With an EPSS score of 1.43% (80.5th percentile), this Fortinet FortiOS vulnerability presents a measurable risk of exploitation.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:NOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| fortinet | fortios | < 6.0.14; >= 6.2.0, < 6.2.10; >= 6.4.0, < 6.4.8; >= 7.0.0, < 7.0.3 |
Multiple CVSS Assessments
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- https://fortiguard.com/psirt/FG-IR-21-201(Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-44168(US Government Resource)
Weakness Type
CWE-494: Download of Code Without Integrity Check
Download of Code Without Integrity Check occurs when software downloads executable code or data from a remote source without verifying that it has not been modified. In the case of Fortinet FortiOS, the "execute restore src-vis" command processes update packages without cryptographic verification, allowing an attacker who has local authenticated access to introduce arbitrary files through specially crafted packages.
Learn more: CWE-494 — Download of Code Without Integrity Check
Impact Analysis
CVE-2021-44168 carries a CVSS 3.1 score of 3.3 (LOW) from the vendor assessment, though NVD assigns a higher score of 7.8 (HIGH), reflecting differing evaluations of the vulnerability's impact. The attack vector is local, meaning an attacker requires existing access to the FortiOS system, and low-level privileges are needed to exploit the flaw. No user interaction is required for exploitation. Integrity (Low): the vulnerability allows unauthorized modification of files on the device, which could lead to configuration tampering or introduction of malicious code. While the vendor-assessed confidentiality and availability impacts are none, the NVD's higher scoring suggests the potential for broader compromise. The EPSS score of 1.43% places this vulnerability in the 80.5th percentile, indicating a notable probability of exploitation activity. Organizations running unpatched FortiOS deployments should prioritize remediation given the confirmed active exploitation status.
Exploit Maturity
CVE-2021-44168 is confirmed as actively exploited, as evidenced by its inclusion in the CISA Known Exploited Vulnerabilities catalog, with a remediation deadline of 2021-12-24. The EPSS score of 1.43% (80.5th percentile) indicates a measurable probability of exploitation. While no public proof-of-concept exploit code has been identified in the available references, the active exploitation status confirms that threat actors have developed working exploits. Federal agencies and organizations following CISA guidance were required to remediate this vulnerability promptly given the short remediation window.
Remediation
- Apply vendor patches immediately as mandated by CISA KEV: Apply updates per vendor instructions. Fortinet has released security advisory FG-IR-21-201 with specific remediation guidance.
- Upgrade all affected FortiOS instances to patched versions: FortiOS 6.0.14 or later for the 6.0.x branch, FortiOS 6.2.10 or later for the 6.2.x branch, FortiOS 6.4.8 or later for the 6.4.x branch, and FortiOS 7.0.3 or later for the 7.0.x branch.
- Implement strict access controls to limit who can execute administrative commands on FortiOS devices, particularly the "execute restore" functionality. Restrict management access to trusted networks only.
- Enable and monitor FortiOS audit logs for any unauthorized use of the "execute restore src-vis" command or unexpected file download activity on managed devices.
- Implement cryptographic verification for all firmware and configuration updates applied to FortiOS devices. Use Fortinet's official update channels and verify file integrity before applying any updates.
Technical Details
CVE-2021-44168 exploits a download of code without integrity check weakness in Fortinet FortiOS. Specifically, the "execute restore src-vis" command does not perform cryptographic verification of update packages before processing them. A local authenticated attacker can craft malicious update packages that, when processed by this command, result in arbitrary file downloads to the FortiOS device. The CVSS vector string (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) indicates that exploitation requires local access with low privileges and low attack complexity, while the scope remains unchanged and the primary impact is on integrity. The vulnerability affects multiple FortiOS release branches spanning versions prior to 6.0.14, 6.2.0 through 6.2.9, 6.4.0 through 6.4.7, and 7.0.0 through 7.0.2.
Frequently Asked Questions
Is CVE-2021-44168 being actively exploited?
Yes. CVE-2021-44168 is listed in the CISA Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. The EPSS score of 1.43% (80.5th percentile) further indicates a notable probability of exploitation activity.
What products are affected by CVE-2021-44168?
CVE-2021-44168 affects Fortinet FortiOS across multiple release branches. Specifically, FortiOS versions prior to 6.0.14, versions 6.2.0 through 6.2.9, versions 6.4.0 through 6.4.7, and versions 7.0.0 through 7.0.2 are all vulnerable.
How do I fix CVE-2021-44168?
Upgrade FortiOS to a patched version: 6.0.14+, 6.2.10+, 6.4.8+, or 7.0.3+ depending on your release branch. Consult Fortinet advisory FG-IR-21-201 for detailed upgrade instructions. Additionally, restrict management access to trusted networks and monitor for unauthorized restore operations.
How severe is CVE-2021-44168?
CVE-2021-44168 has a vendor-assessed CVSS 3.1 score of 3.3 (LOW), while NVD assigns a score of 7.8 (HIGH). Despite the varying severity assessments, the vulnerability is actively exploited and listed in the CISA KEV catalog, making remediation a priority regardless of the CVSS score.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.