PT-2017-17674 · Fortinet · Fortiwlc

Published 2017-10-26 · Updated 2019-10-03 · CVE-2017-7341

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Fortinet FortiWLC versions 6.1-2 through 6.1-5 Fortinet FortiWLC versions 7.0-7 through 7.0-10 Fortinet FortiWLC versions 8.0 through 8.2 Fortinet FortiWLC versions 8.3.0 through 8.3.2

Description The issue allows an authenticated admin user to execute arbitrary system console commands via crafted HTTP requests, specifically through the file management AP script download webUI page.

Recommendations For Fortinet FortiWLC versions 6.1-2 through 6.1-5, consider restricting access to the file management AP script download webUI page until a fix is available. For Fortinet FortiWLC versions 7.0-7 through 7.0-10, consider restricting access to the file management AP script download webUI page until a fix is available. For Fortinet FortiWLC versions 8.0 through 8.2, consider restricting access to the file management AP script download webUI page until a fix is available. For Fortinet FortiWLC versions 8.3.0 through 8.3.2, consider restricting access to the file management AP script download webUI page until a fix is available.

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2017-7341

Affected Products

Fortiwlc

References · 4

• https://fortiguard.com/psirt/FG-IR-17-119 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-7341 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-7341 · Security Note
• http://securityfocus.com/bid/101273 · Note