CVE-2021-42759: fortinet fortinet meru ap OS Command Injection
Modified
Published 09-12-2021Last modified 25-10-2024
Vulnerability summary
CVE-2021-42759 is a high (CVSS 7.2) OS Command Injection vulnerability in fortinet fortinet meru ap. EPSS estimates a 0.27% chance of exploitation in the next 30 days, higher than 18.5% of scored vulnerabilities.
CVSS score
7.2/10
010
High · v2.0 (NVD)EPSS score
0.27%
0%100%
Low · +0.01 pp in 30 daysKEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits0No public exploits recorded
Timeline
- 09-12-2021PublishedVulnerability first disclosed.
- 25-10-2024Last modifiedVulnerability information updated.
Description
A violation of secure design principles in Fortinet Meru AP version 8.6.1 and below, version 8.5.5 and below allows attacker to execute unauthorized code or commands via crafted cli commands.
CVSS metrics
3 scores · 2 sources · 2 versionsMedium 6.7Preferred score · CVE.org (CNA)
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:CSourcesAll 2 agree
- NVDNIST6.7MediumCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
High 7.2Preferred score · NVD (NIST)
AV:L/AC:L/Au:N/C:C/I:C/A:CSourcesSingle source
EPSS trend
Probability
0.27%
Chance of exploitation in the next 30 days
Percentile
19%
Versus all other CVEs
30-day change
Increase +0.01 pp
From 0.26% on 22-09-2026
22-09-202622-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Fortinet2 products
- fortinet meru apMeru AP 8.6.1, 8.6.0, 8.5.5, 8.5.4, 8.5.3, 8.5.2, 8.5.1, 8.5.0
- meru_firmware≥ 8.5.0, ≤ 8.5.5 | ≥ 8.6.0, < 8.6.2
1 vendor · 2 products