CVE-2021-24023

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

An improper input validation in FortiAI v1.4.0 and earlier may allow an authenticated user to gain system shell access via a malicious payload in the "diagnose" command.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

No affected versions have been published.

Timeline

Published
Jun 3, 2021
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-240246.5A clear text storage of sensitive information into log file vulnerability in FortiADCManager 5.3.0 and below, 5.2.1 and below and FortiADC 5CVE-2021-240259.8Due to incorrect string size calculations inside the preg_quote function, a large input string passed to the function can trigger an integerCVE-2021-240269.8A missing bounds check within the audio decoding pipeline for WhatsApp calls in WhatsApp for Android prior to v2.21.3, WhatsApp Business forCVE-2021-240277.5A cache configuration issue prior to WhatsApp for Android v2.21.4.18 and WhatsApp Business for Android v2.21.4.18 may have allowed a third pCVE-2021-240289.8An invalid free in Thrift's table-based serialization can cause the application to crash or potentially result in code execution or other unCVE-2021-240297.5A packet of death scenario is possible in mvfst via a specially crafted message during a QUIC session, which causes a crash via a failed assCVE-2021-24035.3Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are CVE-2021-240309.8The fbgames protocol handler registered as part of Facebook Gameroom does not properly quote arguments passed to the executable. That allowsCVE-2021-240315.5In the Zstandard command-line utility prior to v1.4.1, output files were created with default permissions. Correct file permissions (matchinCVE-2021-240324.7Beginning in v1.4.1 and prior to v1.4.9, due to an incomplete fix for CVE-2021-24031, the Zstandard command-line utility created output fileCVE-2021-240335.6react-dev-utils prior to v11.0.4 exposes a function, getProcessForPort, where an input argument is concatenated into a command string to be CVE-2021-240359.1A lack of filename validation when unzipping archives prior to WhatsApp for Android v2.21.8.13 and WhatsApp Business for Android v2.21.8.13
CVE-2021-24023: High severity, CVSS 8.8 | Vulnix