Analysis Summary

CVE-2021-26093 CVSS:6.6

An access of uninitialized pointer (CWE-824) vulnerability in FortiWLC versions 8.6.0, 8.5.3 and earlier may allow a local and authenticated attacker to crash the access point being managed by the controller by executing a crafted CLI command.

CVE-2020-12819 CVSS:5.4

A heap-based buffer overflow vulnerability in the processing of Link Control Protocol messages in FortiGate versions 5.6.12, 6.0.10, 6.2.4 and 6.4.1 and earlier may allow a remote attacker with valid SSL VPN credentials to crash the SSL VPN daemon by sending a large LCP packet, when tunnel mode is enabled. Arbitrary code execution may be theoretically possible, albeit practically very difficult to achieve in this context.

Impact

• Gain Access
• Buffer Overflow

Indicators of Compromise

CVE

• CVE-2021-26093
• CVE-2020-12819

Affected Vendors

Remediation

Refer to Fortinet Security Advisory for patch, upgrade, or suggested workaround information.

CVE-2021-26093

CVE-2020-12819