CVE-2016-6909

CVE Database · CVE-2016-6909

CVE-2016-6909

· N/AModified

CVSS v3.1

N/A

EPSS

49.86%

Published

Aug 24, 2016

Modified

May 6, 2026

Public PoC / Exploit (2)

All weaponized →

Exploit-DBFortigate Firewalls - 'EGREGIOUSBLUNDER' Remote Code Execution TrickestTrickest PoC index

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

Buffer overflow in the Cookie parser in Fortinet FortiOS 4.x before 4.1.11, 4.2.x before 4.2.13, and 4.3.x before 4.3.9 and FortiSwitch before 3.4.3 allows remote attackers to execute arbitrary code via a crafted HTTP request, aka EGREGIOUSBLUNDER.

Weaknesses (CWE)

CWE-119

Affected Products (4)

fortinet · fortios (up to 4.1.11)vulnerable

fortinet · fortios (up to 4.2.13)vulnerable

fortinet · fortios (up to 4.3.9)vulnerable

fortinet · fortiswitchvulnerable

References (12)

http://fortiguard.com/advisory/FG-IR-16-023

Vendor Advisory

http://packetstormsecurity.com/files/138387/EGREGIOUSBLUNDER-Fortigate-Remote-Code-Execution.html

ExploitThird Party AdvisoryVDB Entry

http://www.securityfocus.com/bid/92523

Third Party AdvisoryVDB Entry

http://www.securitytracker.com/id/1036643

Third Party AdvisoryVDB Entry

https://musalbas.com/2016/08/16/equation-group-firewall-operations-catalogue.html

Third Party Advisory

https://www.exploit-db.com/exploits/40276/

KEV Catalog EPSS Scores Vendors All CVEs