Fortinet Fortiwlc vulnerabilities

14 CVEs affecting Fortinet Fortiwlc, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2021-32584, published 2025-03-17.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2017-7341, published 2017-10-26. High severity, CVSS 7.2. EPSS: 3.9% chance of exploitation in the next 30 days. An OS Command Injection vulnerability in Fortinet FortiWLC 6.1-2 through 6.1-5, 7.0-7 through 7.0-10, 8.0 through 8.2, and 8.3.0 through 8.3.2 file management AP script download webUI page allows an…
CVE-2016-7560, published 2016-10-05. Critical severity, CVSS 9.8. EPSS: 2.7% chance of exploitation in the next 30 days. The rsyncd server in Fortinet FortiWLC 6.1-2-29 and earlier, 7.0-9-1, 7.0-10-0, 8.0-5-0, 8.1-2-0, and 8.2-4-0 has a hardcoded rsync account, which allows remote attackers to read or write to…
CVE-2021-42758, published 2021-12-08. High severity, CVSS 8.8. EPSS: 2% chance of exploitation in the next 30 days. An improper access control vulnerability [CWE-284] in FortiWLC 8.6.1 and below may allow an authenticated and remote attacker with low privileges to execute any command as an admin user with full…
CVE-2017-17540, published 2018-05-08. Critical severity, CVSS 9.8. EPSS: 2% chance of exploitation in the next 30 days. The presence of a hardcoded account in Fortinet FortiWLC 8.3.3 allows attackers to gain unauthorized read/write access via a remote shell.
CVE-2017-17539, published 2018-05-08. Critical severity, CVSS 9.8. EPSS: 2% chance of exploitation in the next 30 days. The presence of a hardcoded account in Fortinet FortiWLC 7.0.11 and earlier allows attackers to gain unauthorized read/write access via a remote shell.
CVE-2016-8491, published 2017-02-01. Critical severity, CVSS 9.1. EPSS: 1.5% chance of exploitation in the next 30 days. The presence of a hardcoded account named 'core' in Fortinet FortiWLC allows attackers to gain unauthorized read/write access via a remote shell.
CVE-2016-7561, published 2016-10-05. High severity, CVSS 7.2. EPSS: 1.1% chance of exploitation in the next 30 days. Fortinet FortiWLC 6.1-2-29 and earlier, 7.0-9-1, 7.0-10-0, 8.0-5-0, 8.1-2-0, and 8.2-4-0 allow administrators to obtain sensitive user credentials by reading the pam.log file.
CVE-2020-9288, published 2020-06-22. Medium severity, CVSS 5.4. EPSS: 0.9% chance of exploitation in the next 30 days. An improper neutralization of input vulnerability in FortiWLC 8.5.1 allows a remote authenticated attacker to perform a stored cross site scripting attack (XSS) via the ESS profile or the Radius…
CVE-2021-32584, published 2025-03-17. Medium severity, CVSS 5.3. EPSS: 0.6% chance of exploitation in the next 30 days. An improper access control (CWE-284) vulnerability in FortiWLC version 8.6.0, version 8.5.3 and below, version 8.4.8 and below, version 8.3.3 and below, version 8.2.7 to 8.2.4, version 8.1.3 may…
CVE-2017-7335, published 2017-10-26. Medium severity, CVSS 5.4. EPSS: 0.5% chance of exploitation in the next 30 days. A Cross-Site Scripting (XSS) vulnerability in Fortinet FortiWLC 6.1-x (6.1-2, 6.1-4 and 6.1-5); 7.0-x (7.0-7, 7.0-8, 7.0-9, 7.0-10); and 8.x (8.0, 8.1, 8.2 and 8.3.0-8.3.2) allows an authenticated…

Latest

CVE-2021-26087, published 2025-03-17. Medium severity, CVSS 6.1. EPSS: 0.3% chance of exploitation in the next 30 days. An improper neutralization of input during web page generation in FortiWLC version 8.6.0, version 8.5.3 and below, version 8.4.8 and below, version 8.3.3 web interface may allow both authenticated…
CVE-2021-22126, published 2025-03-17. Medium severity, CVSS 6.7. EPSS: 0.2% chance of exploitation in the next 30 days. A use of hard-coded password vulnerability in FortiWLC version 8.5.2 and below, version 8.4.8 and below, version 8.3.3 to 8.3.2, version 8.2.7 to 8.2.6 may allow a local, authenticated attacker to…
CVE-2022-23439, published 2025-01-22. Medium severity, CVSS 6.1. EPSS: 0.4% chance of exploitation in the next 30 days. A externally controlled reference to a resource in another sphere vulnerability in Fortinet allows attacker to poison web caches via crafted HTTP requests, where the `Host` header points to an…
CVE-2021-26093, published 2024-12-19. Medium severity, CVSS 6.5. EPSS: 0.2% chance of exploitation in the next 30 days. An access of uninitialized pointer (CWE-824) vulnerability in FortiWLC versions 8.6.0, 8.5.3 and earlier may allow a local and authenticated attacker to crash the access point being managed by the…