CVE-2021-32584 Missing authorization in FortiWLC

What is CVE-2021-32584?

CVE-2021-32584 is a medium-severity missing authorization vulnerability in Fortinet FortiWLC, published on 17 Mar 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

An improper access control (CWE-284) vulnerability in FortiWLC version 8.6.0, version 8.5.3 and below, version 8.4.8 and below, version 8.3.3 and below, version 8.2.7 to 8.2.4, version 8.1.3 may allow an unauthenticated and remote attacker to access certain areas of the web management CGI functionality by just specifying the correct URL. The vulnerability applies only to limited CGI resources and might allow the unauthorized party to access configuration details.

Weakness: CWE-284

Which versions are affected by CVE-2021-32584?

It affects 1 product.

Products include Fortinet Fortiwlc.

How do I fix CVE-2021-32584?

No fix has been published for CVE-2021-32584 yet. Limit exposure of the affected software until one is available.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2021-32584 being exploited?

There is no known exploitation of CVE-2021-32584 in the wild and no public exploit code.

Other vulnerabilities in Fortinet FortiWLC

• CVE-2017-17539 Hardcoded credentials in FortiWLC Critical 9.8
• CVE-2017-17540 Hardcoded credentials in FortiWLC Critical 9.8
• CVE-2016-7560 Hardcoded credentials in n/a Critical 9.8
• CVE-2016-8491 Hardcoded credentials in Fortinet FortiWLC Critical 9.1
• CVE-2021-42758 Privilege escalation in Fortinet FortiWLC High 8.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-9cc9-h5mf-w5fr.