LiveActive security incident?Get immediate response
CVE Record

CVE-2021-26106: An improper neutralization of special elements used in an OS Command vulnerability in FortiAP's console 6.4...

An improper neutralization of special elements used in an OS Command vulnerability in FortiAP's console 6.4.1 through 6.4.5 and 6.2.4 through 6.2.5 may allow an authenticated attacker to execute unauthorized commands by running the kdbg CLI command with specifically crafted arguments.

HighCVSS 7.8Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

This Fortinet FortiAP vulnerability could let a logged-in attacker run unauthorized operating-system commands from the device console. Business risk is highest where affected access points are still on the listed firmware and console or CLI access is available to non-administrative or shared accounts.

Executive priority

Treat as a high-priority appliance hardening issue, not an internet-scale emergency based on the provided evidence. Prioritize affected FortiAP estates with shared credentials, broad admin access, or weak management-plane controls.

Technical view

CVE-2021-26106 is OS command injection in FortiAP console handling of the kdbg CLI command arguments. The listed CVSS 3.1 vector is local, low complexity, low privilege, no user interaction, with high confidentiality, integrity, and availability impact.

Likely exposure

Exposure is limited to FortiAP-W2 and FortiAP-S 6.2.4 through 6.2.5, and FortiAP 6.4.1 through 6.4.5, especially where authenticated users can access the device console or CLI.

Exploitation context

The source bundle does not indicate active exploitation, and KEV is false. The documented attack path requires an authenticated attacker with local console/CLI context and crafted arguments to a specific CLI command.

Researcher notes

The public bundle supports command injection impact and affected version ranges, but it does not provide exploit details, fixed versions, or confirmed exploitation. Validation should focus on model/version inventory and authenticated console access paths.

Mitigation direction

  • Inventory FortiAP-W2, FortiAP-S, and FortiAP firmware versions.
  • Check Fortinet advisory FG-IR-20-210 for vendor upgrade or mitigation guidance.
  • Restrict console and CLI access to trusted administrators only.
  • Review shared or low-privilege FortiAP accounts and remove unnecessary access.
  • Monitor FortiAP administration activity for suspicious console usage.

Validation and detection

  • Confirm whether deployed FortiAP models match the affected product list.
  • Verify firmware versions against 6.2.4-6.2.5 and 6.4.1-6.4.5 ranges.
  • Confirm who has authenticated console or CLI access to affected devices.
  • Check change logs and admin logs for unexpected CLI activity.
  • Document remediation status against Fortinet advisory FG-IR-20-210.
Prepared
Confidence
medium
Sources
3

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2021-26106 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
7.8 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
0Timeline events
0ADP providers
2Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
7.8CVSS 3.1HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9Primary CVE score

Vulnerability scoring details

Base CVSS 3.1 score

7.8High
CVSS 3.1 vector shape for CVE-2021-26106Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
FortinetFortinet FortiAP-W2, FortiAP-S, FortiAPFortiAP-W2 6.2.4 through 6.2.5; FortiAP-S 6.2.4 through 6.2.5; FortiAP 6.4.1 through 6.4.5Listed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.