{"api_version":"1","generated_at":"2026-07-24T22:41:04+00:00","cve":"CVE-2021-22127","urls":{"html":"https://cve.report/CVE-2021-22127","api":"https://cve.report/api/cve/CVE-2021-22127.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2021-22127","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2021-22127"},"summary":{"title":"CVE-2021-22127","description":"An improper input validation vulnerability in FortiClient for Linux 6.4.x before 6.4.3, FortiClient for Linux 6.2.x before 6.2.9 may allow an unauthenticated attacker to execute arbitrary code on the host operating system as root via tricking the user into connecting to a network with a malicious name.","state":"PUBLIC","assigner":"psirt@fortinet.com","published_at":"2022-04-06 16:15:00","updated_at":"2022-04-13 18:00:00"},"problem_types":["CWE-78"],"metrics":[],"references":[{"url":"https://fortiguard.com/advisory/FG-IR-20-241","name":"https://fortiguard.com/advisory/FG-IR-20-241","refsource":"CONFIRM","tags":[],"title":"PSIRT Advisories | FortiGuard","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-22127","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-22127","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2021","cve_id":"22127","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"fortinet","cpe5":"forticlient","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"linux","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"data_type":"CVE","data_format":"MITRE","data_version":"4.0","CVE_data_meta":{"ID":"CVE-2021-22127","ASSIGNER":"psirt@fortinet.com","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"vendor_name":"Fortinet","product":{"product_data":[{"product_name":"Fortinet FortiClientLinux","version":{"version_data":[{"version_value":"FortiClientLinux 6.4.2 and below, FortiClientLinux 6.2.8 and below"}]}}]}}]}},"impact":{"cvss":{"attackComplexity":"High","attackVector":"Adjacent","availabilityImpact":"High","baseScore":6.7,"baseSeverity":"Medium","confidentialityImpact":"High","integrityImpact":"High","privilegesRequired":"None","scope":"Unchanged","userInteraction":"Required","vectorString":"CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:X/RC:X","version":"3.1"}},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"Execute unauthorized code or commands"}]}]},"references":{"reference_data":[{"refsource":"CONFIRM","name":"https://fortiguard.com/advisory/FG-IR-20-241","url":"https://fortiguard.com/advisory/FG-IR-20-241"}]},"description":{"description_data":[{"lang":"eng","value":"An improper input validation vulnerability in FortiClient for Linux 6.4.x before 6.4.3, FortiClient for Linux 6.2.x before 6.2.9 may allow an unauthenticated attacker to execute arbitrary code on the host operating system as root via tricking the user into connecting to a network with a malicious name."}]}},"nvd":{"publishedDate":"2022-04-06 16:15:00","lastModifiedDate":"2022-04-13 18:00:00","problem_types":["CWE-78"],"metrics":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","attackVector":"ADJACENT_NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH","baseScore":8,"baseSeverity":"HIGH"},"exploitabilityScore":2.1,"impactScore":5.9},"baseMetricV2":{"cvssV2":{"version":"2.0","vectorString":"AV:A/AC:M/Au:N/C:C/I:C/A:C","accessVector":"ADJACENT_NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"COMPLETE","integrityImpact":"COMPLETE","availabilityImpact":"COMPLETE","baseScore":7.9},"severity":"HIGH","exploitabilityScore":5.5,"impactScore":10,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":true}},"configurations":{"CVE_data_version":"4.0","nodes":[{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:fortinet:forticlient:*:*:*:*:*:linux:*:*","versionEndExcluding":"6.2.9","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:fortinet:forticlient:*:*:*:*:*:linux:*:*","versionStartIncluding":"6.4.0","versionEndExcluding":"6.4.3","cpe_name":[]}]}]}},"legacy_mitre":{"record":{"CveYear":"2021","CveId":"22127","Ordinal":"196822","Title":"CVE-2021-22127","CVE":"CVE-2021-22127","Year":"2021"},"notes":[{"CveYear":"2021","CveId":"22127","Ordinal":"1","NoteData":"** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided.","Type":"Description","Title":null}]}}}