« Back to list

CVE-2017-7341

Status: ModifiedHigh (7.2)—

An OS Command Injection vulnerability in Fortinet FortiWLC 6.1-2 through 6.1-5, 7.0-7 through 7.0-10, 8.0 through 8.2, and 8.3.0 through 8.3.2 file management AP script download webUI page allows an authenticated admin user to execute arbitrary system console commands via crafted HTTP requests.

CVSS

Exploitation probability (EPSS)

EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).

Affected technologies (1)

Fortinet — Fortiwlc

CWEs

References

Raw JSON (NVD)

Show
{
  "id": "CVE-2017-7341",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2017-7341",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-10-24T20:04:08.221212Z"
        }
      }
    ],
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 9,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C",
          "authentication": "SINGLE",
          "integrityImpact": "COMPLETE",
          "accessComplexity": "LOW",
          "availabilityImpact": "COMPLETE",
          "confidentialityImpact": "COMPLETE"
        },
        "acInsufInfo": false,
        "impactScore": 10,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": true,
        "exploitabilityScore": 8,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.0",
          "baseScore": 7.2,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 1.2
      }
    ]
  },
  "affected": [
    {
      "source": "psirt@fortinet.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2017-10-26T13:29:00.370",
  "references": [
    {
      "url": "http://www.securityfocus.com/bid/101273",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "psirt@fortinet.com"
    },
    {
      "url": "https://fortiguard.com/psirt/FG-IR-17-119",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "psirt@fortinet.com"
    },
    {
      "url": "http://www.securityfocus.com/bid/101273",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://fortiguard.com/psirt/FG-IR-17-119",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-78"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "An OS Command Injection vulnerability in Fortinet FortiWLC 6.1-2 through 6.1-5, 7.0-7 through 7.0-10, 8.0 through 8.2, and 8.3.0 through 8.3.2 file management AP script download webUI page allows an authenticated admin user to execute arbitrary system console commands via crafted HTTP requests."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad de inyección de comandos de sistema operativo en la interfaz de usuario web para la descarga de scripts en el punto de acceso al gestor de archivo ene Fortinet FortiWLC, desde la versión 6.1-2 hasta la 6.1-5, desde la 7.0-7 hasta la 7.0-10, la 8.0 hasta la 8.2 y la 8.3.0 hasta la 8.3.2 permite que un usuario administrador autenticado ejecute comandos arbitrarios de la consola del sistema mediante peticiones HTTP manipuladas."
    }
  ],
  "lastModified": "2026-06-17T01:24:10.007",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:fortinet:fortiwlc:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "32B5AEE4-D578-49CB-82B8-BB234EC09F82",
              "versionEndIncluding": "6.1-5",
              "versionStartIncluding": "6.1-2"
            },
            {
              "criteria": "cpe:2.3:a:fortinet:fortiwlc:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C743E7EB-4C55-482D-B39A-51EF4E1AF19E",
              "versionEndIncluding": "7.0-10",
              "versionStartIncluding": "7.0-7"
            },
            {
              "criteria": "cpe:2.3:a:fortinet:fortiwlc:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6413A393-8FFC-46BC-92F1-DEA776815122",
              "versionEndIncluding": "8.2",
              "versionStartIncluding": "8.0"
            },
            {
              "criteria": "cpe:2.3:a:fortinet:fortiwlc:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5210AB0C-6778-42D9-8353-ABD2E4C1C2AB",
              "versionEndIncluding": "8.3.2",
              "versionStartIncluding": "8.3.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "psirt@fortinet.com"
}