VYPR
← All advisories
High severity7.8NVD Advisory· Published Dec 8, 2021· Updated Jun 17, 2026

CVE-2021-26110

CVE-2021-26110

Description

An improper access control vulnerability [CWE-284] in FortiOS autod daemon 7.0.0, 6.4.6 and below, 6.2.9 and below, 6.0.12 and below and FortiProxy 2.0.1 and below, 1.2.9 and below may allow an authenticated low-privileged attacker to escalate their privileges to super_admin via a specific crafted configuration of fabric automation CLI script and auto-script features.

Affected products

8
  • Fortinet/Fortiproxy5 versions
    cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:*+ 4 more
    • cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:*range: >=1.0.0,<=1.0.7
    • cpe:2.3:a:fortinet:fortiproxy:2.0.0:*:*:*:*:*:*:*
    • cpe:2.3:a:fortinet:fortiproxy:2.0.1:*:*:*:*:*:*:*
    • (no CPE)range: <=2.0.1, <=1.2.9
    • (no CPE)range: FortiOS 7.0.0, 6.4.6 and below, 6.2.9 and below, 6.0.12 and below. FortiProxy 2.0.1 and below, 1.2.9 and below
  • Fortinet/Fortios3 versions
    cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*+ 2 more
    • cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*range: >=5.6.0,<=5.6.14
    • cpe:2.3:o:fortinet:fortios:7.0.0:*:*:*:*:*:*:*
    • (no CPE)range: <=7.0.0, <=6.4.6, <=6.2.9, <=6.0.12

Patches

Vulnerability mechanics

References

1

News mentions

0

No linked articles in our index yet.