CVE-2016-7560
CriticalSummary
The rsyncd server in Fortinet FortiWLC versions 6.1-2-29 and earlier, 7.0-9-1, 7.0-10-0, 8.0-5-0, 8.1-2-0, and 8.2-4-0 has a hardcoded rsync account, allowing remote attackers to read or write to arbitrary files via unspecified vectors.
Risk Assessment
This vulnerability poses a risk of unauthorized access to files, potentially leading to loss of data confidentiality and modification of critical system files.
Recommendation
It is recommended to upgrade to the latest version of FortiWLC to remove the hardcoded rsync account and minimize the risk associated with this vulnerability.
Other vulnerabilities in Fortinet FortiWLC
See all- CVE-2016-7561High
Fortinet FortiWLC versions 6.1-2-29 and earlier, 7.0-9-1, 7.0-10-0, 8.0-5-0, 8.1-2-0, and 8.2-4-0 allow administrators to obtain sensitive user credentials by reading the pam.log file.
- CVE-2016-8491Critical
The presence of a hardcoded account named 'core' in Fortinet FortiWLC allows attackers to gain unauthorized read/write access via a remote shell.
Original NVD description (English source)
The rsyncd server in Fortinet FortiWLC 6.1-2-29 and earlier, 7.0-9-1, 7.0-10-0, 8.0-5-0, 8.1-2-0, and 8.2-4-0 has a hardcoded rsync account, which allows remote attackers to read or write to arbitrary files via unspecified vectors.