How severe is CVE-2021-44168?

CVE-2021-44168 has a CVSS 3.1 base score of 3.3 (LOW). EPSS estimates a 0.9% probability of exploitation in the next 30 days. It is listed in the CISA Known Exploited Vulnerabilities catalog.

CVE-2021-44168: Fortinet FortiOS Arbitrary File

CISA Known Exploited Vulnerabilities

Fortinet FortiOS Arbitrary File Download is confirmed as actively exploited and is listed in the CISA KEV catalog.

Added to KEV

2021-12-10

Remediation due

2021-12-24

Required action
Apply updates per vendor instructions.

CISA notes
https://nvd.nist.gov/vuln/detail/CVE-2021-44168

Description

A download of code without integrity check vulnerability in the "execute restore src-vis" command of FortiOS before 7.0.3 may allow a local authenticated attacker to download arbitrary files on the device via specially crafted update packages.

Severity

CVSS 3.1 · CNA3.3 LOW

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N/E:P/RL:U/RC:C

SSVC · CISA-ADP

Exploitationactive

Automatableno

Technical impactpartial

Affected Products

Vendor	Product	Affected versions
Fortinet	Fortinet FortiOS	FortiOS before 7.0.3

References

1 Links

Other references

https://fortiguard.com/psirt/FG-IR-21-201

Record Details

Published

2022-01-04

Last updated

2025-10-21

Assigner (CNA)

fortinet

Credited to

More from Fortinet

CVE-2018-133799.1

Fortinet FortiOS SSL VPN Path Traversal Vulnerability

CVE-2022-406849.8

Fortinet Multiple Products Authentication Bypass Vulnerability

CVE-2025-252579.6

Fortinet FortiWeb SQL Injection Vulnerability

CVE-2022-424759.3

Fortinet FortiOS Heap-Based Buffer Overflow Vulnerability

CVE record data © The MITRE Corporation, used under the CVE Terms of Use. Exploited-in-the-wild data from the CISA Known Exploited Vulnerabilities catalog (CC0). Exploit prediction scores by FIRST EPSS (first.org/epss). This site is not endorsed or certified by MITRE, NVD, CISA, or FIRST.