CVE-2021-43075

HIGH

Fortinet FortiWLM <8.6.2-<8.5.2-<8.4.2-<8.3.2 - Command Injection

Title source: llm

Description

A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWLM version 8.6.2 and below, version 8.5.2 and below, version 8.4.2 and below, version 8.3.2 and below allows attacker to execute unauthorized code or commands via crafted HTTP requests to the alarm dashboard and controller config handlers.

References (1)

Core 1

Core References

Vendor Advisory x_refsource_confirm

https://fortiguard.com/advisory/FG-IR-21-128

Scores

CVSS v3 8.8

EPSS 0.0118

EPSS Percentile 79.0%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact total

Details

CWE

CWE-78

Status published

Products (1)

fortinet/fortiwlm < 8.3.2

Published Mar 01, 2022

Tracked Since Feb 18, 2026