CVE-2021-44168: Fortinet FortiOS Arbitrary File Download

CVE-2021-44168 is an arbitrary file download weakness in Fortinet FortiOS. It stems from the "execute restore src-vis" function downloading code without integrity checking, which can let an attacker cause the system to retrieve files of their choosing. For IT and security teams running FortiOS, this matters because devices that enforce network policy are high-value targets; successful abuse can undermine device integrity and open paths to further compromise. Confirm all product and version details against the vendor advisory before acting.

How it works

The underlying issue is CWE-494: download of code without integrity checking. In this case, a FortiOS administrative or restore-related command path fetches external content and does not adequately verify that the material is authentic or untampered before use. An attacker who can influence the download source or the conditions under which the command runs may cause the device to pull arbitrary files instead of expected, vendor-supplied content.

At a high level, the abuse path involves triggering or abusing the restore/src-vis style download so that the appliance retrieves attacker-controlled data. Exact preconditions, required privileges, and network reachability are not fully detailed in the public summary; treat any internet-facing or broadly reachable management plane as higher risk and validate the precise attack surface in the vendor advisory. No exploit mechanics beyond the CISA description should be assumed.

Am I affected? How to find it in your systems

FortiOS typically runs on Fortinet FortiGate firewalls and related security appliances that sit at network perimeters, in data centers, or as virtual instances. Inventory every Fortinet device under management: check hardware and virtual FortiGate fleets, HA pairs, and any management or orchestration systems that push configuration to them.

• Collect running firmware/OS version strings from each device (CLI, GUI, or central management console) and compare them to the fixed releases listed in the Fortinet advisory for CVE-2021-44168.
• Identify whether the "execute restore src-vis" (or equivalent restore/source-visibility) functionality is used in operational procedures or automation; note any scripts or operators that invoke restore-style downloads.
• Review management-plane exposure: which interfaces allow administrative CLI/GUI access, and whether those interfaces are reachable from untrusted networks.
• For exploitation signs, examine device and syslog for unexpected restore or download activity, configuration changes around source-visibility features, anomalous outbound connections from the appliance, or sudden file-system or process anomalies. Correlate with authentication logs for unusual admin sessions. Specific log signatures should be confirmed against vendor and community detection guidance.

How to remediate

Patch first. Apply the FortiOS updates that Fortinet released for this issue, following the vendor’s instructions exactly. CISA’s required action is to apply updates per vendor instructions; schedule maintenance windows promptly for internet-facing and critical path devices.

• After upgrading, verify the new version string and re-check that the vulnerable command path behaves as documented in the fixed release.
• Restrict administrative access to trusted jump hosts or management networks only; enforce strong authentication and least privilege for any account that can run restore or download commands.
• Disable or tightly control any non-essential restore/source-visibility features if operationally feasible, and ensure outbound connectivity from appliances is limited to required update and threat-intelligence destinations.
• Maintain configuration backups and change-control records so you can detect unauthorized alterations after the fact.

If you can't patch immediately

Until the vendor update is installed, reduce exposure with compensating controls aimed at this class of integrity-check failures.

• Segment and firewall the management plane so that only authorized administrators and management systems can reach FortiOS CLI/GUI services; block the vulnerable function’s use from untrusted sources.
• If a web application firewall or virtual-patching capability sits in front of management interfaces, apply rules that restrict or alert on restore/download-related requests; tune carefully to avoid breaking legitimate operations.
• Temporarily disable or remove automation that invokes "execute restore src-vis" (or equivalent) until patched versions are running.
• Heighten monitoring: alert on admin logins, restore commands, unexpected outbound connections from the appliance, and configuration drift. Retain logs off-box for investigation.
• Ensure appliances cannot freely reach arbitrary external hosts; allow-list only necessary update and support endpoints.

If your data may have been exposed

Actively exploited vulnerabilities on network devices can lead to broader breaches, even when ransomware use is not documented for this CVE. If you have indicators of compromise or suspect the device was abused, follow your incident-response process: isolate affected systems, preserve logs and disk images, rotate credentials and certificates that traversed the device, and assess downstream impact. As a routine hygiene step, you can run a free exposure scan of your email addresses against known breach data sets to see whether associated accounts appear in prior incidents.