Description
A hard-coded account named 'upgrade' in Fortinet FortiWLM 8.3.0 and lower versions allows a remote attacker to log-in and execute commands with 'upgrade' account privileges.
References (2)
Core 2
Core References
Third Party Advisory, VDB Entry vdb-entry
x_refsource_bid
http://www.securityfocus.com/bid/99351
Vendor Advisory x_refsource_confirm
https://fortiguard.com/advisory/FG-IR-17-115
Scores
CVSS v3
9.8
EPSS
0.0094
EPSS Percentile
76.5%
Attack Vector
NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
yes
Technical Impact
total
Details
CWE
CWE-798
Status
published
Products (2)
fortinet/fortiwlm
< 8.3.0
Fortinet, Inc./Fortinet FortiWLM
8.3.0 and lower
Published
Jul 22, 2017
Tracked Since
Feb 18, 2026