CVE-2016-4066
HighSummary
CVE-2016-4066 is a CSRF vulnerability in Fortinet FortiWeb before version 5.5.3 that allows remote attackers to hijack the authentication of administrators for password change requests via unspecified vectors.
Risk Assessment
Attackers can exploit this vulnerability to unauthorizedly change administrator passwords, potentially leading to loss of control over the system.
Recommendation
It is recommended to update FortiWeb to version 5.5.3 or later to mitigate this vulnerability.
Other vulnerabilities in Fortinet FortiWeb
See all- CVE-2025-64446CriticalActively exploited
A relative path traversal vulnerability in Fortinet FortiWeb versions 8.0.0-8.0.1, 7.6.0-7.6.4, 7.4.0-7.4.9, 7.2.0-7.2.11, and 7.0.0-7.0.11 may allow an attacker to execute administrative commands via crafted HTTP or HTTPS requests.
- CVE-2025-52970High
An improper handling of parameters vulnerability in Fortinet FortiWeb 7.6.0 through 7.6.3, 7.4.0 through 7.4.7, 7.2.0 through 7.2.10, 7.0.0 through 7.0.10 may allow an unauthenticated remote attacker with non-public information pertaining to the device and targeted user to gain admin privileges on the device via a specially crafted request.
- CVE-2026-70466Medium
Fortinet FortiWeb (versions 8.0.0–8.0.2, 7.6.0–7.6.5, all 7.4, all 7.2, all 7.0) contains an incomplete list of disallowed inputs (CWE-184). An attacker can achieve improper access control via specifically crafted requests.
- CVE-2026-39811Medium
An integer overflow or wraparound vulnerability in Fortinet FortiWeb versions 8.0.0 through 8.0.3, 7.6.0 through 7.6.6, 7.4, 7.2, and 7.0 may allow an attacker to cause a denial of service.
- CVE-2026-30897Medium
Fortinet FortiWeb (versions 8.0.0–8.0.3, 7.6.0–7.6.6, 7.4.0–7.4.11, all 7.2, all 7.0) contains a stack-based buffer overflow. A remote authenticated attacker able to bypass stack protection and ASLR can execute arbitrary code or commands via crafted HTTP requests.
- CVE-2026-24640Medium
Fortinet FortiWeb (versions 8.0.0–8.0.2, 7.6.0–7.6.6, all 7.4, all 7.2, 7.0.2–7.0.12) contains a stack-based buffer overflow (CWE-121). A remote authenticated attacker able to bypass stack protection and ASLR can execute arbitrary code or commands via crafted HTTP requests.
- CVE-2023-23783Medium
Fortinet FortiWeb versions 7.0.0 through 7.0.1 and FortiWeb 6.4 all versions contain a use of externally-controlled format string vulnerability allowing an attacker to execute unauthorized code or commands via specially crafted command arguments.
Original NVD description (English source)
Cross-site request forgery (CSRF) vulnerability in Fortinet FortiWeb before 5.5.3 allows remote attackers to hijack the authentication of administrators for requests that change the password via unspecified vectors.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS