« Volver al listado

CVE-2016-7560

Estado: ModificadaCrítica (9.8)—

The rsyncd server in Fortinet FortiWLC 6.1-2-29 and earlier, 7.0-9-1, 7.0-10-0, 8.0-5-0, 8.1-2-0, and 8.2-4-0 has a hardcoded rsync account, which allows remote attackers to read or write to arbitrary files via unspecified vectors.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Fortinet — Fortiwlc

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2016-7560",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 10,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
          "authentication": "NONE",
          "integrityImpact": "COMPLETE",
          "accessComplexity": "LOW",
          "availabilityImpact": "COMPLETE",
          "confidentialityImpact": "COMPLETE"
        },
        "acInsufInfo": true,
        "impactScore": 10,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.0",
          "baseScore": 9.8,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2016-10-05T16:59:07.900",
  "references": [
    {
      "url": "http://fortiguard.com/advisory/FG-IR-16-029",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/bid/93286",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://fortiguard.com/advisory/FG-IR-16-029",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/93286",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-798"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The rsyncd server in Fortinet FortiWLC 6.1-2-29 and earlier, 7.0-9-1, 7.0-10-0, 8.0-5-0, 8.1-2-0, and 8.2-4-0 has a hardcoded rsync account, which allows remote attackers to read or write to arbitrary files via unspecified vectors."
    },
    {
      "lang": "es",
      "value": "El servidor rsyncd en Fortinet FortiWLC 6.1-2-29 y versiones anteriores, 7.0-9-1, 7.0-10-0, 8.0-5-0, 8.1-2-0 y 8.2-4-0 tiene una cuenta rsync embebida, lo que permite a atacantes remotos leer o escribir archivos arbitrarios a través de vectores no especificados."
    }
  ],
  "lastModified": "2026-06-17T00:53:14.683",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:fortinet:fortiwlc:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "66B34DBA-D142-48C5-81BB-341EFCBA3002",
              "versionEndIncluding": "6.1-2-29"
            },
            {
              "criteria": "cpe:2.3:a:fortinet:fortiwlc:7.0-9-1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FD17F5C3-C9C3-41C2-9F01-BF37D39FE424"
            },
            {
              "criteria": "cpe:2.3:a:fortinet:fortiwlc:7.0-10-0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "077E32D0-4309-486F-8240-7E381F4A11D3"
            },
            {
              "criteria": "cpe:2.3:a:fortinet:fortiwlc:8.0-5-0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "509453A9-97DC-48B0-A62F-9752CE5C6B76"
            },
            {
              "criteria": "cpe:2.3:a:fortinet:fortiwlc:8.1-2-0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8F3D7433-DE22-4406-848C-B16E6CE9BE03"
            },
            {
              "criteria": "cpe:2.3:a:fortinet:fortiwlc:8.2-4-0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5D237E43-F18A-4A4A-8938-D0DDF24AD681"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}