LiveActive security incident?Get immediate response
CVE Record

CVE-2021-41032: An improper access control vulnerability [CWE-284] in FortiOS versions 6.4.8 and prior and 7.0.3 and prior...

An improper access control vulnerability [CWE-284] in FortiOS versions 6.4.8 and prior and 7.0.3 and prior may allow an authenticated attacker with a restricted user profile to gather sensitive information and modify the SSL-VPN tunnel status of other VDOMs using specific CLI commands.

MediumCVSS 6.3Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

CVE-2021-41032 lets a restricted, authenticated FortiOS user access sensitive information and change SSL-VPN tunnel status for other VDOMs. It is not an unauthenticated internet takeover, but it weakens tenant or segmentation boundaries inside managed FortiGate environments.

Executive priority

Treat as a moderate priority for FortiGate environments with delegated administration or multi-VDOM segmentation. Prioritize patch planning and account review, especially where administrators are numerous or externally managed.

Technical view

The issue is CWE-284 improper access control in FortiOS CLI behavior. A low-privileged authenticated user profile may use specific CLI commands to read sensitive data and modify SSL-VPN tunnel state across VDOM boundaries. CVSS is 6.3 with network access, low complexity, and low privileges required.

Likely exposure

Exposure is likely where FortiGate/FortiOS deployments use VDOMs, SSL-VPN, and delegated or restricted administrator accounts on affected releases: 7.0.3 and earlier, 6.4.8 and earlier, and listed 6.2.x versions.

Exploitation context

The source bundle does not show CISA KEV listing or confirmed active exploitation. The vulnerability requires authentication with a restricted user profile, so risk is highest from compromised, shared, or delegated administrative accounts.

Researcher notes

Evidence is limited to the CVE record and Fortinet advisory reference. Do not assume unauthenticated exploitation or broader product impact. Validation should focus on affected FortiOS versions, restricted profile exposure, VDOM use, and SSL-VPN operational logs.

Mitigation direction

  • Check Fortinet FG-IR-21-147 for fixed releases and any vendor workaround.
  • Upgrade affected FortiOS systems according to Fortinet guidance.
  • Restrict CLI access to trusted administrative users only.
  • Review restricted admin profiles for unnecessary VDOM or SSL-VPN privileges.
  • Monitor SSL-VPN tunnel status changes and cross-VDOM administrative activity.

Validation and detection

  • Inventory FortiOS versions across all FortiGate appliances.
  • Flag systems running 7.0.3 or earlier, 6.4.8 or earlier, or listed 6.2.x releases.
  • Confirm whether VDOMs and SSL-VPN are enabled on flagged systems.
  • Review FortiOS administrator accounts with restricted profiles.
  • Check logs for unusual CLI activity or SSL-VPN tunnel status changes.
Prepared
Confidence
high
Sources
3

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2021-41032 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Medium
CVSS
6.3 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:H/RL:W/RC:C

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
0Timeline events
0ADP providers
2Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
6.3CVSS 3.1MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:H/RL:W/RC:C2.83.4Primary CVE score

Vulnerability scoring details

Base CVSS 3.1 score

6.3Medium
CVSS 3.1 vector shape for CVE-2021-41032Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:H/RL:W/RC:C

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
FortinetFortinet FortiOSFortiOS 7.0.3, 7.0.2, 7.0.1, 7.0.0, 6.4.8, 6.4.7, 6.4.6, 6.4.5, 6.4.4, 6.4.3, 6.4.2, 6.4.1, 6.4.0, 6.2.10, 6.2.9, 6.2.8, 6.2.7, 6.2.6, 6.2.5, 6.2.4, 6.2.3, 6.2.2, 6.2.1, 6.2.0Listed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.