LiveActive security incident?Get immediate response
CVE Record

CVE-2021-43204: A improper control of a resource through its lifetime in Fortinet FortiClientWindows version 6.4.1 and 6.4....

A improper control of a resource through its lifetime in Fortinet FortiClientWindows version 6.4.1 and 6.4.0, version 6.2.9 and below, version 6.0.10 and below allows attacker to cause a complete denial of service of its components via changes of directory access permissions.

MediumCVSS 4.4Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

This Fortinet FortiClient Windows flaw can let a local attacker with high privileges break FortiClient components by changing directory permissions. The cited data does not indicate data theft or remote compromise, but it can remove endpoint or VPN functionality on affected Windows systems.

Executive priority

Treat as a moderate endpoint resilience issue. It is not described as remote code execution or data exposure, but affected FortiClient Windows deployments may lose security or VPN functionality if an already-privileged local attacker tampers with permissions.

Technical view

CVE-2021-43204 is a FortiClientWindows resource-lifetime control issue. CVSS 3.1 rates it 4.4: local access, low complexity, high privileges, no user interaction, and high availability impact only. Affected versions include 6.4.1, 6.4.0, 6.2.9 and below, 6.0.10 and below, plus older listed releases.

Likely exposure

Exposure is limited to Windows endpoints running affected Fortinet FortiClientWindows versions. The attacker needs local access with high privileges, so highest concern is shared workstations, compromised admin accounts, or environments where endpoint protection availability is critical.

Exploitation context

The source bundle does not show CISA KEV listing or active exploitation. The CVSS vector says exploitation requires local access and high privileges, with denial of service as the documented impact.

Researcher notes

Evidence supports local, high-privilege denial of service only. No CWE is provided in the bundle. The CVSS temporal vector indicates functional exploit maturity and official remediation, but the supplied advisory text does not name specific fixed releases.

Mitigation direction

  • Inventory Windows endpoints running FortiClientWindows versions listed as affected.
  • Review Fortinet advisory FG-IR-21-167 for fixed or supported upgrade guidance.
  • Prioritize upgrade or replacement of unsupported legacy FortiClient versions.
  • Restrict local administrative privileges on managed Windows endpoints.
  • Monitor endpoint management for FortiClient component failures or tampering.

Validation and detection

  • Check FortiClientWindows version across endpoint management inventory.
  • Confirm whether installed versions match the affected version list.
  • Review local admin group membership on systems running FortiClientWindows.
  • Validate FortiClient components remain running after permission or policy changes.
  • Record remediation status against Fortinet advisory FG-IR-21-167.
Prepared
Confidence
medium
Sources
3

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2021-43204 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Medium
CVSS
4.4 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H/E:F/RL:O/RC:C

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
0Timeline events
0ADP providers
2Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
4.4CVSS 3.1MediumCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H/E:F/RL:O/RC:C0.83.6Primary CVE score

Vulnerability scoring details

Base CVSS 3.1 score

4.4Medium
CVSS 3.1 vector shape for CVE-2021-43204Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H/E:F/RL:O/RC:C

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
FortinetFortinet FortiClientWindowsFortiClientWindows 6.4.1, 6.4.0, 6.2.9, 6.2.8, 6.2.7, 6.2.6, 6.2.5, 6.2.4, 6.2.3, 6.2.2, 6.2.1, 6.2.0, 6.0.10, 6.0.9, 6.0.8, 6.0.7, 6.0.6, 6.0.5, 6.0.4, 6.0.3, 6.0.2, 6.0.1, 6.0.0, 5.6.6, 5.6.5, 5.6.4, 5.6.3, 5.6.2, 5.6.1, 5.6.0, 5.4.5, 5.4.4, 5.4.3, 5.4.2, 5.4.1, 5.4.0, 5.2.6, 5.2.5, 5.2.4, 5.2.3, 5.2.2, 5.2.1, 5.2.0, 5.0.11, 5.0.10, 5.0.9, 5.0.8, 5.0.7, 5.0.6, 5.0.5, 5.0.4, 5.0.3, 5.0.2, 5.0.1, 5.0.0, 4.3.5, 4.3.4, 4.3.3, 4.3.2, 4.3.1, 4.3.0, 4.2.7, 4.2.6, 4.2.5, 4.2.4, 4.2.3, 4.2.2, 4.2.1, 4.2.0, 4.1.3, 4.1.2, 4.1.1, 4.1.0, 4.0.4, 4.0.3, 4.0.2, 4.0.1Listed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.