Security readout for executives and security teams
Plain-English summary
CVE-2021-24023 affects Fortinet FortiAI 1.4.0 and earlier. A logged-in user could abuse weak input validation in the diagnose command to obtain system shell access, potentially leading to full compromise of the appliance.
Executive priority
Treat as high priority where FortiAI is deployed, because a low-privileged authenticated user may gain system shell access. Prioritize inventory, access restriction, and vendor-guided remediation.
Technical view
The flaw is improper input validation in FortiAI's diagnose command. CVSS 3.1 is 7.8 with local attack vector, low complexity, low privileges required, no user interaction, and high confidentiality, integrity, and availability impact.
Likely exposure
Exposure is limited to FortiAI deployments running version 1.4.0 or earlier. The source bundle does not identify internet exposure, default credentials, or unauthenticated attack paths.
Exploitation context
The bundle does not show CISA KEV listing or cited evidence of active exploitation. Exploitation requires an authenticated user and access to the affected diagnose command path.
Researcher notes
Evidence is narrow but consistent: affected product, version range, attack preconditions, and impact are stated in the CVE bundle. No exploit details, proof of exploitation, or exact fixed version are included in the supplied sources.
Mitigation direction
- Identify any FortiAI systems running 1.4.0 or earlier.
- Review Fortinet advisory FG-IR-21-033 for the vendor-supported remediation.
- Restrict FortiAI access to trusted administrators only.
- Remove unnecessary user accounts with access to FortiAI commands.
- Monitor for unexpected shell access or suspicious diagnose command use.
Validation and detection
- Inventory FortiAI versions across all environments.
- Confirm whether any instance is FortiAI 1.4.0 or earlier.
- Review who can authenticate to affected FortiAI systems.
- Check logs for unusual diagnose command activity.
- Verify remediation against Fortinet's advisory guidance.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2021-24023 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Source materials
- CVE List V5 sourceCVE List V5
- https://fortiguard.com/advisory/FG-IR-21-033CVE reference · x_refsource_CONFIRM
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.