CVE-2021-42758 Privilege escalation in Fortinet FortiWLC

What is CVE-2021-42758?

CVE-2021-42758 is a high-severity vulnerability in Fortinet FortiWLC, published on 8 Dec 2021. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

An improper access control vulnerability [CWE-284] in FortiWLC 8.6.1 and below may allow an authenticated and remote attacker with low privileges to execute any command as an admin user with full access rights via bypassing the GUI restrictions.

Weakness: CWE-863

Which versions are affected by CVE-2021-42758?

It affects 1 product.

Products include Fortinet Fortiwlc.

How do I fix CVE-2021-42758?

No fix has been published for CVE-2021-42758 yet. Limit exposure of the affected software until one is available.

Is CVE-2021-42758 being exploited?

There is no known exploitation of CVE-2021-42758 in the wild and no public exploit code.

Other vulnerabilities in Fortinet FortiWLC

• CVE-2017-17539 Hardcoded credentials in FortiWLC Critical 9.8
• CVE-2017-17540 Hardcoded credentials in FortiWLC Critical 9.8
• CVE-2016-7560 Hardcoded credentials in n/a Critical 9.8
• CVE-2016-8491 Hardcoded credentials in Fortinet FortiWLC Critical 9.1
• CVE-2017-7341 Command injection in n/a High 7.2

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-85xx-79fp-6rmf.