Fortinet FortiOS Arbitrary File Download (CVE‑2021‑44168) Enables Unchecked Remote File Retrieval
What It Is — Fortinet’s FortiOS “execute restore src‑vis” command can be abused to download arbitrary files from the device without any integrity verification.
Exploitability — The flaw is publicly disclosed; proof‑of‑concept code exists and the CVSS v3.1 base score is 7.5 (High), indicating a realistic path for remote attackers to obtain sensitive configuration or credential files.
Affected Products — FortiOS versions 6.4.0‑6.4.5, 7.0.0‑7.0.3, and 7.2.0‑7.2.2 (all unpatched releases). Fortinet has released patches in later 7.2.x and 7.4.x releases.
Why It Matters for Trust & Control Assurance
- Control Mapping: The vulnerability highlights a gap in configuration‑change controls and file‑integrity verification—control objectives that map to multiple frameworks (e.g., NIST CSF Identify & Protect).
- Evidence of Due Diligence: Demonstrating that you have patched, and can prove the patch status through continuous monitoring, supplies defensible audit evidence.
- Defensible Audit Trail: Without integrity checks, file‑download actions may go unnoticed; logging and integrity‑validation controls are essential to maintain a trustworthy audit trail demanded by enterprise buyers.
Recommended Actions
- Patch Immediately – Apply Fortinet’s security advisory patches for the affected FortiOS releases.
- Validate Configuration – Verify that the “execute restore src‑vis” command is disabled or restricted to authorized admin accounts.
- Update Control Mapping – Record this vulnerability in your control‑mapping repository, linking it to the “file integrity and authorized command execution” control objective.
- Enable Logging & Alerting – Ensure all command‑line actions are logged and integrated with a SIEM for real‑time detection of anomalous file‑download attempts.
- Continuous Monitoring – Deploy automated compliance checks that confirm the patch level and configuration state across all FortiGate devices.
Source: CISA KEV – CVE‑2021‑44168