PT-2017-17670 · Fortinet · Fortiwlm

Publicado 2017-07-22 · Atualizado 2017-07-27 · CVE-2017-7336

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Fortinet FortiWLM versions 8.3.0 and lower

Description A remote attacker can log in and execute commands with 'upgrade' account privileges due to a hard-coded account named 'upgrade'.

Recommendations For Fortinet FortiWLM versions 8.3.0 and lower, consider changing the default password of the upgrade account or restricting access to this account to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Using Hardcoded Credentials

Enumeração de Fraquezas

CWE-798

Identificadores relacionados

CVE-2017-7336

Produtos afetados

Fortiwlm

Referências · 4

• http://securityfocus.com/bid/99351 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2017-7336 · Nota de Segurança
• https://fortiguard.com/advisory/FG-IR-17-115 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2017-7336 · Aviso do Fabricante