PT-2017-17670 · Fortinet · Fortiwlm

Published 2017-07-22 · Updated 2017-07-27 · CVE-2017-7336

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Fortinet FortiWLM versions 8.3.0 and lower

Description A remote attacker can log in and execute commands with 'upgrade' account privileges due to a hard-coded account named 'upgrade'.

Recommendations For Fortinet FortiWLM versions 8.3.0 and lower, consider changing the default password of the upgrade account or restricting access to this account to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

Related Identifiers

CVE-2017-7336

Affected Products

Fortiwlm

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2017-7336 · Security Note
• https://fortiguard.com/advisory/FG-IR-17-115 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-7336 · Vendor Advisory
• http://securityfocus.com/bid/99351 · Note