FortiadcApplication · Fortinet
CVE-2021-43076
Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.
NVD · uneditedAn improper privilege management vulnerability [CWE-269] in FortiADC versions 6.2.1 and below, 6.1.5 and below, 6.0.4 and below, 5.4.5 and below and 5.3.7 and below may allow a remote authenticated attacker with restricted user profile to modify the system files using the shell access.
Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.
dbcve analysis · high confidenceFortiADC versions prior to patches contain an improper privilege management vulnerability (CWE-269) where authenticated users with restricted (low-privilege) user profiles can gain shell access and modify system files. This represents a privilege escalation issue allowing restricted users to bypass intended access controls.
Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.
Affected products & versions What the vendor confirmedThe version ranges the vendor confirmed as vulnerable. If your version sits inside a range here, treat yourself as exposed until you have upgraded.
NVD · CPE data
FortiadcApplication
>= 5.3.0, <= 5.3.7>= 5.4.0, <= 5.4.5>= 6.0.0, <= 6.0.4>= 6.1.0, <= 6.1.5= 6.2.0= 6.2.1CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.
From the vector- Attack vector
- Network
- Complexity
- Low
- Privileges
- Low
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- None
- Integrity
- High
- Availability
- None
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.
dbcve checksWork through these to decide whether this CVE applies to you.
-
Identify FortiADC installed versionRun command: get system status or fnsysctl cat /etc/version from CLI to retrieve the firmware versionAffected if Version falls within 5.3.0-5.3.7, 5.4.0-5.4.5, 6.0.0-6.0.4, 6.1.0-6.1.5, 6.2.0-6.2.1
-
List configured user profilesRun: get system admin user from CLI to see all admin accounts and their profile assignmentsAffected if Any user is assigned a restricted (low-privilege) profile such as guestmanager or limited_admin
-
Check shell access permissions for restricted usersRun: show system admin for each restricted user account and inspect the accprofile field; look for whether shell access is enabled or if accprofile grants more permissions than intendedAffected if Restricted user accounts have shell access enabled or have elevated accprofile permissions beyond what should be granted
-
Review user profileaccprofile configurationRun: get system accprofile to list all available access profiles and their granted permissions, particularly checking for any custom profiles granting shell/execute permissions to low-privilege usersAffected if Any restricted profile inadvertently includes shell or execute command permissions
-
Audit system logs for shell access from low-privilege accountsRun: execute log filter category 2 (system events) and review logs for any commands executed by users with restricted profiles; check for unexpected shell or execute CLI commandsAffected if Logs show shell access or execute commands originating from accounts assigned restricted profiles
You are affected if your FortiADC version is within the listed affected ranges AND you have restricted user profiles configured with shell access enabled or elevated permissions.
Generated from the published advisory. Verify against your own configuration.
Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.
dbcve · scopedUpgrade FortiADC to versions 6.3.0 or above, 6.2.2 or above, 6.1.6 or above, 6.0.5 or above, 5.4.6 or above, or 5.3.8 or above as specified in Fortinet advisory. If immediate patching is not possible, restrict shell access permissions for restricted user profiles and monitor for unauthorized access.
Upgrade to FortiADC 5.3.8, 5.4.6, 6.0.5, 6.1.6, or later releases (6.2.x and above if available)
- 1. Identify the current FortiADC version by checking System > FortiGuard in the web UI or running 'get system status' in CLI
- 2. Based on the current version line, plan upgrade to the appropriate fixed release: 5.3.8+, 5.4.6+, 6.0.5+, or 6.1.6+
- 3. Backup the FortiADC configuration via Dashboard > Backup/Restore or CLI command 'execute backup full-config'
- 4. Download the firmware file from Fortinet Support Portal (https://support.fortinet.com) for the target fixed version
- 5. Upload the firmware through System > Firmware in the web UI or via 'execute firmware upload' CLI command
- 6. After upload, initiate the firmware upgrade and allow the system to reboot
- 7. Verify the upgrade was successful by checking the version with 'get system status' and confirm the build number matches the expected fixed release
- 8. Validate that restricted user profiles no longer have shell access capability by reviewing User > User Group > User Profile settings
Generated from the published advisory — verify against the referenced sources before acting.
Fix this in Fortiadc
Scoped from the published advisory
- Consultation4.0 h
- Implementation8.0 h
- Testing6.0 h
- Review / QA2.0 h
An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $5,600.
Scan for this in your stack
Free · runs locallyCheck whether your project pulls in CVE-2021-43076 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.
References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.
Primary sourcesPractitioner notes
ContributedPeer-ranked notes from engineers who’ve handled CVE-2021-43076 in production — separate from our analysis above.
The advisory tells you what broke. It rarely tells you what actually worked. If you’ve dealt with this one, that detail is what the next engineer is searching for.
- The version that genuinely resolved it — not the one the vendor claimed
- A config change or rule that shut the vector down
- A gotcha in the upgrade path that cost you an afternoon
No notes yet
Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.
A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.
- Verified mitigations, workarounds, and config changes
- Version or environment caveats, and links to real fixes
- No weaponised exploit code, or anything meant to cause harm
- No spam, self-promotion, credentials, or personal data