CVE-2021-26111

Published: Jun 1, 2021Modified: Nov 21, 2024

6.5

Vector

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitability: 2.8 / Impact: 3.6

Source: NVD

Description

A missing release of memory after effective lifetime vulnerability in FortiSwitch 6.4.0 to 6.4.6, 6.2.0 to 6.2.6, 6.0.0 to 6.0.6, 3.6.11 and below may allow an attacker on an adjacent network to exhaust available memory by sending specifically crafted LLDP/CDP/EDP packets to the device.

Affected (4)

Products: Fortinet: Fortiswitch

1 product

Configuration A

4 vulnerable

Vulnerable Software	Affected Versions
Fortinet Fortiswitch	Up to 3.6.11
Fortinet Fortiswitch	From 6.0.0 to 6.0.6
Fortinet Fortiswitch	From 6.2.0 to 6.2.6
Fortinet Fortiswitch	From 6.4.0 to 6.4.6

Related CWEs

Missing Release of Memory after Effective Lifetime

The product does not sufficiently track and release allocated memory after it has been used, which slowly consumes remaining memory.

References (2)

https://fortiguard.com/advisory/FG-IR-21-026

Source: psirt@fortinet.com

Vendor Advisory

https://fortiguard.com/advisory/FG-IR-21-026

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.