LiveActive security incident?Get immediate response
CVE Record

CVE-2021-36180: Multiple improper neutralization of special elements used in a command vulnerabilities [CWE-77] in FortiWeb...

Multiple improper neutralization of special elements used in a command vulnerabilities [CWE-77] in FortiWeb management interface 6.4.1 and below, 6.3.15 and below, 6.2.5 and below may allow an authenticated attacker to execute unauthorized code or commands via crafted parameters of HTTP requests.

HighCVSS 8.1Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

CVE-2021-36180 is a Fortinet FortiWeb management interface command-injection issue. An attacker with valid low-privilege access could send crafted HTTP request parameters that cause unauthorized commands or code to run. The main business risk is tampering with the web application firewall or disrupting its availability.

Executive priority

Prioritize remediation for any affected FortiWeb system with reachable management access. The issue requires authentication, but successful abuse could undermine integrity or availability of a security control protecting public applications.

Technical view

The source describes multiple CWE-77 command neutralization flaws in FortiWeb management interface versions 6.4.1 and below, 6.3.15 and below, and 6.2.5 and below. CVSS 3.1 is 8.1: network reachable, low complexity, low privilege required, no user interaction, with high integrity and availability impact.

Likely exposure

Exposure is limited to organizations running affected FortiWeb versions where the management interface is reachable by authenticated users. Internet exposure is not stated in the provided sources; verify actual management-plane accessibility in your environment.

Exploitation context

The CVE is not listed as CISA KEV in the bundle. The CVSS vector includes functional exploit maturity, but the provided sources do not establish active exploitation. Treat this as serious because low-privileged authenticated access is enough to trigger high-impact outcomes.

Researcher notes

Evidence is sufficient for affected-version triage and impact assessment, but the bundle does not include exploit details, concrete indicators, or named fixed versions. Use Fortinet’s advisory as the authoritative remediation source and avoid assuming broader Fortinet product impact.

Mitigation direction

  • Check FortiGuard advisory FG-IR-21-120 for official fixed versions or workarounds.
  • Upgrade affected FortiWeb systems according to Fortinet guidance.
  • Restrict FortiWeb management access to trusted administrative networks only.
  • Review administrative accounts and remove unnecessary low-privilege access.
  • Increase monitoring on FortiWeb management interface activity.

Validation and detection

  • Inventory all FortiWeb appliances and record their exact firmware versions.
  • Compare versions against 6.4.1 and below, 6.3.15 and below, and 6.2.5 and below.
  • Confirm whether the management interface is reachable from untrusted networks.
  • Review management logs for unusual authenticated HTTP requests or configuration changes.
  • After remediation, verify the version is outside the affected ranges.
Prepared
Confidence
high
Sources
3

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2021-36180 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
8.1 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H/E:F/RL:U/RC:C

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
0Timeline events
0ADP providers
2Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
8.1CVSS 3.1HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H/E:F/RL:U/RC:C2.85.2Primary CVE score

Vulnerability scoring details

Base CVSS 3.1 score

8.1High
CVSS 3.1 vector shape for CVE-2021-36180Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H/E:F/RL:U/RC:C

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
FortinetFortinet FortiWebFortiWeb 6.4.1 and below, 6.3.15 and below, 6.2.5 and belowListed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.