Summary
generated automatically from NVD dataThe FTP component in Fortinet FortiGate 2.8 running FortiOS (including 2.8MR10 and v3beta, and other versions before 3.0 MR1) contains a flaw in how it handles file uploads. A remote attacker can send a STOR command and begin uploading a file before the FTP server response has been sent, which bypasses the Fortinet FTP anti-virus engine. This was demonstrated with the LFTP client, and the issue is rated 10.0 (HIGH) under CVSS v2.0.
NVD description
The FTP component in FortiGate 2.8 running FortiOS 2.8MR10 and v3beta, and other versions before 3.0 MR1, allows remote attackers to bypass the Fortinet FTP anti-virus engine by sending a STOR command and uploading a file before the FTP server response has been sent, as demonstrated using LFTP.
EPSS · FIRST.org
2.7%probability of exploitation in the next 30 days
Higher than 85% of scored CVEs
EPSS (Exploit Prediction Scoring System) estimates, from observed exploitation activity, how likely a CVE is to be exploited in the next 30 days. It complements CVSS, which measures severity, not likelihood. Score of 2026-10-19, recomputed daily by FIRST.org.
CVSS v2.0 Score
Information
- Published
- 31 déc. 2005
- Updated
- 16 juin 2026
- Status
- Modified
- Source
- cve@mitre.org
Affected products
Weaknesses (CWE)
References (12)
- http://secunia.com/advisories/18844Vendor Advisory
- http://www.vupen.com/english/advisories/2006/0539Vendor Advisory
- http://secunia.com/advisories/18844Vendor Advisory
- http://www.vupen.com/english/advisories/2006/0539Vendor Advisory
Similar CVEs
Other vulnerabilities of type
Monitor your products
Get automatic alerts for every new CVE affecting your equipment.