CVE-2021-22126: Fortinet Fortiwlc

Medium severity, CVSS 6.7. EPSS: 0.2% chance of exploitation in the next 30 days.

A use of hard-coded password vulnerability in FortiWLC version 8.5.2 and below, version 8.4.8 and below, version 8.3.3 to 8.3.2, version 8.2.7 to 8.2.6 may allow a local, authenticated attacker to connect to the managed Access Point (Meru AP and FortiAP-U) as root using the default hard-coded username and password.

Affected products

• Fortinet Fortiwlc: from 8.4.0, before 8.5.3 (fixed in 8.5.3); version 8.2.6 only; version 8.2.7 only; version 8.3.2 only; version 8.3.3 only

Published 2025-03-17. Last modified 2026-06-17.