PT-2022-9715 · Fortinet · Fortiwan

Published 2022-04-06 · Updated 2022-04-13 · CVE-2021-26113

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions FortiWAN versions prior to 4.5.9

Description A use of a one-way hash with a predictable salt vulnerability in FortiWAN may allow an attacker who has previously come in possession of the password file to potentially guess passwords therein stored.

Recommendations For versions prior to 4.5.9, update to version 4.5.9 or later to resolve the issue. As a temporary workaround, consider restricting access to the password file to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-916

Related Identifiers

CVE-2021-26113

Affected Products

Fortiwan

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2021-26113 · Security Note
• https://osv.dev/vulnerability/CVE-2021-26113 · Vendor Advisory
• https://fortiguard.com/psirt/FG-IR-21-064 · Vendor Advisory
• https://t.me/cibsecurity/40244 · Telegram Post