{"id":"CVE-2016-6909","aliases":["EUVD-2016-7794","GHSA-f3wq-8j4r-5p8m"],"status":"published","title":"Buffer overflow in the Cookie parser in Fortinet FortiOS 4.x before 4.1.11, 4.2.x before 4.2.13,...","description":"Buffer overflow in the Cookie parser in Fortinet FortiOS 4.x before 4.1.11, 4.2.x before 4.2.13, and 4.3.x before 4.3.9 and FortiSwitch before 3.4.3 allows remote attackers to execute arbitrary code via a crafted HTTP request, aka EGREGIOUSBLUNDER.","severity":{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.49856,"percentile":0.98907,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-119"],"published":"2016-08-24T16:00:00Z","modified":"2026-06-17T00:51:58Z","exploits":[{"source":"exploitdb","id":"EDB-40276","title":"Fortigate Firewalls - 'EGREGIOUSBLUNDER' Remote Code Execution","type":"webapps","platform":"hardware","date":"2016-08-19","url":"https://www.exploit-db.com/exploits/40276"}],"products":[{"vendor":"fortinet","product":"fortios"},{"vendor":"fortinet","product":"fortiswitch"}],"references":[{"url":"http://fortiguard.com/advisory/FG-IR-16-023","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory"]},{"url":"https://musalbas.com/2016/08/16/equation-group-firewall-operations-catalogue.html","tags":["x_refsource_MISC","x_transferred","Third Party Advisory"]},{"url":"http://www.securitytracker.com/id/1036643","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred","Third Party Advisory","VDB Entry"]},{"url":"http://packetstormsecurity.com/files/138387/EGREGIOUSBLUNDER-Fortigate-Remote-Code-Execution.html","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://www.exploit-db.com/exploits/40276/","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred","Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://www.securityfocus.com/bid/92523","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-6909"},{"url":"https://www.exploit-db.com/exploits/40276"},{"url":"https://github.com/advisories/GHSA-f3wq-8j4r-5p8m"}],"sources":{"cve":[{"id":"CVE-2016-6909","description":"Buffer overflow in the Cookie parser in Fortinet FortiOS 4.x before 4.1.11, 4.2.x before 4.2.13, and 4.3.x before 4.3.9 and FortiSwitch before 3.4.3 allows remote attackers to execute arbitrary code via a crafted HTTP request, aka EGREGIOUSBLUNDER.","status":"published","published":"2016-08-24T16:00:00Z","modified":"2024-08-06T01:43:38.599Z","updated_at":"2026-11-02T14:33:34.443637Z"}],"euvd":[{"id":"EUVD-2016-7794","description":"Buffer overflow in the Cookie parser in Fortinet FortiOS 4.x before 4.1.11, 4.2.x before 4.2.13, and 4.3.x before 4.3.9 and FortiSwitch before 3.4.3 allows remote attackers to execute arbitrary code via a crafted HTTP request, aka EGREGIOUSBLUNDER.","status":"published","published":"2016-08-24T16:00:00Z","modified":"2024-08-06T01:43:38Z","updated_at":"2026-11-03T02:22:35.048987Z"}],"ghsa":[{"id":"GHSA-f3wq-8j4r-5p8m","title":"Buffer overflow in the Cookie parser in Fortinet FortiOS 4.x before 4.1.11, 4.2.x before 4.2.13,...","description":"Buffer overflow in the Cookie parser in Fortinet FortiOS 4.x before 4.1.11, 4.2.x before 4.2.13, and 4.3.x before 4.3.9 and FortiSwitch before 3.4.3 allows remote attackers to execute arbitrary code via a crafted HTTP request, aka EGREGIOUSBLUNDER.","status":"published","published":"2022-05-14T01:00:44Z","modified":"2025-04-12T13:04:41Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-119"],"updated_at":"2026-11-02T15:01:29.190007Z"}],"nvd":[{"id":"CVE-2016-6909","description":"Buffer overflow in the Cookie parser in Fortinet FortiOS 4.x before 4.1.11, 4.2.x before 4.2.13, and 4.3.x before 4.3.9 and FortiSwitch before 3.4.3 allows remote attackers to execute arbitrary code via a crafted HTTP request, aka EGREGIOUSBLUNDER.","status":"published","published":"2016-08-24T16:30:00.137Z","modified":"2026-06-17T00:51:58.657Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":10,"vector":"AV:N/AC:L/Au:N/C:C/I:C/A:C","level":"high","assessor":"primary"}],"cwes":["CWE-119"],"updated_at":"2026-11-02T14:03:28.854267Z"}]}}