CVE-2021-26105
Published: 24 March 2025
Summary
CVE-2021-26105 is a medium-severity Improperly Implemented Security Check for Standard (CWE-358) vulnerability in Fortinet Fortisandbox. Its CVSS base score is 6.8 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked in the top 44.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Timely flaw remediation through vendor patching directly eliminates the stack-based buffer overflow vulnerability in the FortiSandbox profile parser.
Information input validation on HTTP requests to the profile parser prevents buffer overflows from specially crafted inputs exceeding expected sizes.
Memory protection mechanisms like stack canaries and data execution prevention mitigate exploitation of the stack-based buffer overflow for unauthorized code execution.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Stack-based buffer overflow in profile parser allows authenticated low-privilege remote attacker to trigger arbitrary code/command execution via crafted HTTP requests, directly enabling privilege escalation through software vulnerability exploitation.
NVD Description
A stack-based buffer overflow vulnerability (CWE-121) in the profile parser of FortiSandbox version 3.2.2 and below, version 3.1.4 and below may allow an authenticated attacker to potentially execute unauthorized code or commands via specifically crafted HTTP requests.
Deeper analysisAI
CVE-2021-26105 is a stack-based buffer overflow vulnerability (CWE-121) affecting the profile parser in FortiSandbox versions 3.2.2 and below, as well as versions 3.1.4 and below. Additional associated weakness enumerations include CWE-358 and CWE-787. The vulnerability, published on 2025-03-24, carries a CVSS v3.1 base score of 6.8 (AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H) and can be triggered via specifically crafted HTTP requests.
An authenticated attacker with low privileges (PR:L) can exploit this issue remotely over the network (AV:N), though it requires high attack complexity (AC:H) and no user interaction (UI:N). Successful exploitation may allow the attacker to execute unauthorized code or commands, potentially compromising system integrity (I:H) and availability (A:H) without impacting confidentiality (C:N).
Mitigation details are available in the Fortinet PSIRT advisory at https://fortiguard.fortinet.com/psirt/FG-IR-20-234.
Details
- CWE(s)