CVSS 3.0
9.8 criticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HCVE-2016-6909
Buffer overflow in the Cookie parser in Fortinet FortiOS 4.x before 4.1.11, 4.2.x before 4.2.13, and 4.3.x before 4.3.9 and FortiSwitch before 3.4.3 allows remote attackers to execute arbitrary code via a crafted HTTP request, aka EGREGIOUSBLUNDER.
Severity
- EPSS
- 50% chance of exploitation in the next 30 days; higher than 98% of CVEs (scores of 2026-10-31)
- CWE
- CWE-119
- Published
- Modified
- Record from
- the NVD, synced
Affected
- fortinet:fortios
- fortinet:fortiswitch
References
- http://fortiguard.com/advisory/FG-IR-16-023
- http://packetstormsecurity.com/files/138387/EGREGIOUSBLUNDER-Fortigate-Remote-Code-Execution.html
- http://www.securityfocus.com/bid/92523
- http://www.securitytracker.com/id/1036643
- https://musalbas.com/2016/08/16/equation-group-firewall-operations-catalogue.html