CVE-2016-6909 EXPLOIT
9.8
CRITICAL · CVSS 3.0 · EPSS 49.9% (pctl 99)
Patch early
A public exploit exists.
Description
Buffer overflow in the Cookie parser in Fortinet FortiOS 4.x before 4.1.11, 4.2.x before 4.2.13, and 4.3.x before 4.3.9 and FortiSwitch before 3.4.3 allows remote attackers to execute arbitrary code via a crafted HTTP request, aka EGREGIOUSBLUNDER.
Scoring
| CVSS | 9.8 (CRITICAL, v3.0) |
|---|---|
| Vector | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| EPSS | 49.86% — more likely to be exploited than 99% of all CVEs |
| Weakness | CWE-119 |
| On CISA KEV | no |
| Public exploit | yes |
| Published | 2016-08-24 |
| Last modified | 2026-06-17 |
Affected (2)
| Vendor | Product |
|---|---|
| fortinet | fortios |
| fortinet | fortiswitch |
Public exploits
| Source | Title | Date |
|---|---|---|
| exploit-db | Fortigate Firewalls - 'EGREGIOUSBLUNDER' Remote Code Execution | 2016-08-19 |
References
- http://fortiguard.com/advisory/FG-IR-16-023
- http://packetstormsecurity.com/files/138387/EGREGIOUSBLUNDER-Fortigate-Remote-Code-Execution.html
- http://www.securityfocus.com/bid/92523
- http://www.securitytracker.com/id/1036643
- https://musalbas.com/2016/08/16/equation-group-firewall-operations-catalogue.html
- https://www.exploit-db.com/exploits/40276/
- http://fortiguard.com/advisory/FG-IR-16-023
- http://packetstormsecurity.com/files/138387/EGREGIOUSBLUNDER-Fortigate-Remote-Code-Execution.html
- http://www.securityfocus.com/bid/92523
- http://www.securitytracker.com/id/1036643
- https://musalbas.com/2016/08/16/equation-group-firewall-operations-catalogue.html
- https://www.exploit-db.com/exploits/40276/
→ the Explorer · watch your stack · NVD