Use of hard-coded credentials in FortiWLM - CVE-2017-7336
Published: December 9, 2021
Vulnerability identifier: #VU58811
CSH Severity: Critical
CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2017-7336
CWE-ID: CWE-798
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to gain full access to vulnerable system.
The vulnerability exists due to presence of hard-coded credentials in application code. A remote unauthenticated attacker can access the affected system using the hard-coded credentials and execute arbitrary commands with the 'upgrade' account privileges.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
Affected software
FortiWLM
How to mitigate CVE-2017-7336
Install updates from vendor's website.
FortiWLM - update to 8.3.1