« Volver al listado

CVE-2021-42758

Estado: ModificadaAlta (8.8)—

An improper access control vulnerability [CWE-284] in FortiWLC 8.6.1 and below may allow an authenticated and remote attacker with low privileges to execute any command as an admin user with full access rights via bypassing the GUI restrictions.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Fortinet — Fortiwlc

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2021-42758",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2021-42758",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-10-23T14:13:15.441432Z"
        }
      }
    ],
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 9,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C",
          "authentication": "SINGLE",
          "integrityImpact": "COMPLETE",
          "accessComplexity": "LOW",
          "availabilityImpact": "COMPLETE",
          "confidentialityImpact": "COMPLETE"
        },
        "acInsufInfo": false,
        "impactScore": 10,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "psirt@fortinet.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 8.8,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 2.8
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 8.8,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "psirt@fortinet.com",
      "affectedData": [
        {
          "vendor": "Fortinet",
          "product": "Fortinet FortiWLC",
          "versions": [
            {
              "status": "affected",
              "version": "FortiWLC 8.6.1 and below"
            }
          ]
        }
      ]
    }
  ],
  "published": "2021-12-08T11:15:11.887",
  "references": [
    {
      "url": "https://fortiguard.com/advisory/FG-IR-21-200",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "psirt@fortinet.com"
    },
    {
      "url": "https://fortiguard.com/advisory/FG-IR-21-200",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-863"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "An improper access control vulnerability [CWE-284] in FortiWLC 8.6.1 and below may allow an authenticated and remote attacker with low privileges to execute any command as an admin user with full access rights via bypassing the GUI restrictions."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad de control de acceso inapropiado [CWE-284] en FortiWLC versiones 8.6.1 y posteriores, puede permitir a un atacante autenticado y remoto con bajos privilegios ejecutar cualquier comando como usuario administrador con plenos derechos de acceso por medio de omitir las restricciones de la Interfaz Gráfica de Usuario"
    }
  ],
  "lastModified": "2026-06-17T04:10:05.397",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:fortinet:fortiwlc:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "25BFDC85-6897-4460-BFFA-509307495305",
              "versionEndIncluding": "8.2.7",
              "versionStartIncluding": "8.2.4"
            },
            {
              "criteria": "cpe:2.3:a:fortinet:fortiwlc:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "ACFFE94E-710C-4510-9324-CCD328C7FD09",
              "versionEndIncluding": "8.3.3",
              "versionStartIncluding": "8.3.0"
            },
            {
              "criteria": "cpe:2.3:a:fortinet:fortiwlc:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1B888278-5CAD-448A-8AB4-6FFEFFDDE3B2",
              "versionEndIncluding": "8.5.5",
              "versionStartIncluding": "8.5.0"
            },
            {
              "criteria": "cpe:2.3:a:fortinet:fortiwlc:8.0.5:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0DBFF939-7478-4D55-9744-EB43D353C267"
            },
            {
              "criteria": "cpe:2.3:a:fortinet:fortiwlc:8.0.6:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "698FF05A-E710-4F99-93CF-70CB18662823"
            },
            {
              "criteria": "cpe:2.3:a:fortinet:fortiwlc:8.1.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "CD7504A8-52B6-4FFC-A460-1AA6740E271B"
            },
            {
              "criteria": "cpe:2.3:a:fortinet:fortiwlc:8.1.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "DF1BA3B5-77A3-452A-91CD-4B734C54AC48"
            },
            {
              "criteria": "cpe:2.3:a:fortinet:fortiwlc:8.4.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4668970E-2C9D-4658-A382-521B2462B747"
            },
            {
              "criteria": "cpe:2.3:a:fortinet:fortiwlc:8.4.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1B8453C8-9F4D-4467-85AB-14CBD10A3004"
            },
            {
              "criteria": "cpe:2.3:a:fortinet:fortiwlc:8.4.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "537154BA-D93B-4DE3-8EC3-1EFA918200AB"
            },
            {
              "criteria": "cpe:2.3:a:fortinet:fortiwlc:8.4.4:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "73041763-E646-406A-898B-63983C2AEE87"
            },
            {
              "criteria": "cpe:2.3:a:fortinet:fortiwlc:8.4.5:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4D5F5D42-A30F-435B-BFD5-282DD75E957C"
            },
            {
              "criteria": "cpe:2.3:a:fortinet:fortiwlc:8.4.6:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8EB155DF-D4D5-4DD1-B978-1C612A182F5C"
            },
            {
              "criteria": "cpe:2.3:a:fortinet:fortiwlc:8.4.7:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "62DE43F8-E402-4AFD-8E01-C1FBBECA5034"
            },
            {
              "criteria": "cpe:2.3:a:fortinet:fortiwlc:8.4.8:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "59FF326F-1E0A-42FE-B0EC-709BE61AA815"
            },
            {
              "criteria": "cpe:2.3:a:fortinet:fortiwlc:8.6.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "18D7B164-2D5E-427E-81F4-6BBDA51131DC"
            },
            {
              "criteria": "cpe:2.3:a:fortinet:fortiwlc:8.6.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A6647661-B965-41B0-B67A-33F9C050843B"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "psirt@fortinet.com"
}