CVE-2021-42757: Fortinet FortiADC

Medium severity, CVSS 6.7. EPSS: 0.5% chance of exploitation in the next 30 days.

A buffer overflow [CWE-121] in the TFTP client library of FortiOS before 6.4.7 and FortiOS 7.0.0 through 7.0.2, may allow an authenticated local attacker to achieve arbitrary code execution via specially crafted command line arguments.

Affected products

• Fortinet FortiADC: from 5.0.0, up to and including 6.1.5; from 6.2.0, up to and including 6.2.2
• Fortinet Fortianalyzer: from 6.0.0, up to and including 6.4.7; from 7.0.0, up to and including 7.0.2
• Fortinet FortiMail: from 5.4.0, up to and including 6.2.7; from 6.4.0, up to and including 6.4.6; from 7.0.0, up to and including 7.0.2
• Fortinet FortiManager: from 6.0.0, up to and including 6.4.7; from 7.0.0, up to and including 7.0.2
• Fortinet Fortindr: from 1.1.0, up to and including 1.5.2
• Fortinet FortiOS: from 5.0.0, up to and including 6.0.13; from 6.2.0, up to and including 6.2.9; from 6.4.0, up to and including 6.4.7; from 7.0.0, up to and including 7.0.2
• Fortinet FortiOS-6k7k: up to and including 6.2.8; version 6.4.2 only; version 6.4.6 only
• Fortinet Fortiportal: from 5.0.0, up to and including 6.0.10
• Fortinet FortiProxy: from 1.0.0, up to and including 2.0.7; version 7.0.0 only; version 7.0.1 only
• Fortinet Fortirecorder Firmware: from 2.6.0, up to and including 6.0.10; from 6.4.0, up to and including 6.4.2
• Fortinet Fortiswitch: from 6.0.0, up to and including 6.4.9; from 7.0.0, up to and including 7.0.3
• Fortinet Fortivoice: from 6.0.0, up to and including 6.0.10; from 6.4.0, up to and including 6.4.4
• Fortinet FortiWeb: from 5.0.0, up to and including 6.3.16; version 6.4.0 only; version 6.4.1 only

Published 2021-12-08. Last modified 2026-06-17.