CVE-2021-44168

What it actually does

This flaw allows a local authenticated attacker with access to the FortiOS CLI to abuse the `execute restore src-vis` command because downloaded update packages are not sufficiently integrity-validated. By supplying a specially crafted package or package source, the attacker can cause the device to download arbitrary files onto the appliance. Because the vulnerable operation runs in a privileged system context, successful exploitation can affect confidentiality, integrity, and availability, including unauthorized file placement, tampering with device-resident content, and potential follow-on compromise depending on what the attacker can place or trigger.

Why it matters to the business

A compromised FortiOS device can undermine network boundary security, VPN access, routing, inspection, and administrative trust. Although exploitation requires authenticated local access, this CVE is listed in CISA KEV and has been observed exploited in the wild, so organizations should treat exposed or previously compromised FortiOS administration paths as high priority. The CISA remediation due date was 2021-12-24, meaning any remaining vulnerable systems are significantly overdue for remediation and may represent persistent perimeter risk.

How an attack unfolds

An attacker first obtains valid local administrative or CLI-capable access to a vulnerable FortiOS device, commonly through stolen credentials, weak administration exposure, reused passwords, or prior compromise. The attacker prepares or hosts a crafted update package intended for use with the `execute restore src-vis` workflow. They then invoke the vulnerable restore command and direct the device to retrieve the crafted content. Because the vulnerable FortiOS versions do not adequately verify the integrity of the downloaded package, the appliance accepts attacker-controlled content and downloads arbitrary files onto the device. The attacker may then use the placed files to alter device behavior, support persistence, stage additional tooling, or facilitate further compromise of the network managed through the FortiOS appliance.

How to fix it

Upgrade affected FortiOS appliances to FortiOS 7.0.3 or later. If the device is on a different supported FortiOS branch, follow the corresponding Fortinet advisory guidance and upgrade to a fixed release for that branch. Restrict FortiOS administrative access to trusted management networks, require MFA for administrators where supported, disable unused admin accounts, rotate credentials after remediation, and review administrative trusted-host settings. If compromise is suspected, preserve logs, upgrade from a trusted maintenance path, audit configuration and administrator accounts, and consider rebuilding or factory-resetting the appliance from known-good configuration backups if device integrity cannot be established.

How to confirm the fix worked

Confirm remediation by checking the FortiOS version with `get system status` and verifying it reports FortiOS 7.0.3 or later, or another vendor-confirmed fixed release. Review administrative access controls to ensure management interfaces are not broadly reachable and administrator trusted-host restrictions are in place. Validate that no recent use of `execute restore src-vis` occurred from unexpected administrator accounts, source IPs, or maintenance windows. Confirm that firmware and package update operations are obtained only from trusted Fortinet sources or approved internal repositories.

Typical attack path

1. Obtain authenticated local or CLI-capable access to a FortiOS device.
2. Confirm the device is running FortiOS before version 7.0.3.
3. Prepare or host a specially crafted package or file source compatible with the vulnerable `src-vis` restore workflow.
4. Run `execute restore src-vis` and point the device to the attacker-controlled package or source.
5. Abuse the missing integrity check to cause the appliance to download attacker-controlled files.
6. Use the downloaded files for tampering, persistence, staging, or follow-on activity against the device or network.

How to detect it

Review FortiOS event, system, CLI, administrator, and audit logs for execution of `execute restore src-vis`, unexpected restore operations, unusual administrator logins, or package downloads from non-Fortinet or unapproved hosts. Correlate these events with VPN, admin authentication, and management-plane access logs to identify suspicious source IPs, new administrator sessions, failed login bursts followed by success, or activity outside maintenance windows. Inspect network telemetry for FortiOS appliances initiating outbound HTTP, HTTPS, FTP, or TFTP downloads to unfamiliar destinations around the time of restore commands. On the appliance, review configuration changes, unexpected administrator accounts, altered trusted-host settings, and anomalous files or scripts created near the suspected exploitation time. Because exploitation requires authentication, also investigate credential theft, reused administrator passwords, and prior compromise paths.

• execute restore src-vis
• restore src-vis
• src-vis
• get system status
• type=event subtype=system
• type=event subtype=admin
• action=login
• action=logout
• status=success
• status=failed
• FortiOS before 7.0.3

What your security team should do

• Immediately identify all FortiOS appliances and verify whether any are running versions before 7.0.3.
• Prioritize upgrade of vulnerable FortiOS devices because this vulnerability is in CISA KEV and has active in-the-wild exploitation history.
• Review FortiOS admin, event, and CLI logs for use of `execute restore src-vis`, especially before remediation or outside approved maintenance windows.
• Restrict administrative interfaces to dedicated management networks or VPN-only access and remove internet exposure wherever possible.
• Rotate FortiOS administrator credentials and review administrative accounts, trusted hosts, API users, and recently changed configuration.
• Investigate any unexpected outbound downloads from FortiOS devices to non-Fortinet or unapproved hosts.
• If suspicious activity is found, perform a full appliance integrity review and consider rebuilding from trusted firmware and known-good configuration.