PT-2021-7565 · Fortinet · Fortiwlc

Published 2021-12-07 · Updated 2021-12-10 · CVE-2021-42758

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions FortiWLC versions 8.6.1 and below

Description The issue is related to improper access control, allowing an authenticated and remote attacker with low privileges to execute commands as an admin user with full access rights by bypassing GUI restrictions. This can potentially lead to privilege escalation.

Recommendations For FortiWLC versions 8.6.1 and below, consider restricting access to the GUI to minimize the risk of exploitation until a patch is available. As a temporary workaround, limit the privileges of low-level users to prevent them from executing commands that could bypass GUI restrictions. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Access Control

Incorrect Authorization

Weakness Enumeration

CWE-284

CWE-863

Related Identifiers

BDU:2023-00086

CVE-2021-42758

Affected Products

Fortiwlc

References · 5

• https://bdu.fstec.ru/vul/2023-00086 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-42758 · Security Note
• https://fortiguard.com/advisory/FG-IR-21-200 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-42758 · Vendor Advisory
• https://t.me/cvenotify/24406 · Telegram Post