CVE-2016-7561
HighSummary
Fortinet FortiWLC versions 6.1-2-29 and earlier, 7.0-9-1, 7.0-10-0, 8.0-5-0, 8.1-2-0, and 8.2-4-0 allow administrators to obtain sensitive user credentials by reading the pam.log file.
Risk Assessment
Organizations may be exposed to unauthorized access to user data, potentially leading to serious security breaches.
Recommendation
It is recommended to secure access to the pam.log file and update FortiWLC to the latest version to minimize risk.
Other vulnerabilities in Fortinet FortiWLC
See all- CVE-2016-8491Critical
The presence of a hardcoded account named 'core' in Fortinet FortiWLC allows attackers to gain unauthorized read/write access via a remote shell.
- CVE-2016-7560Critical
The rsyncd server in Fortinet FortiWLC versions 6.1-2-29 and earlier, 7.0-9-1, 7.0-10-0, 8.0-5-0, 8.1-2-0, and 8.2-4-0 has a hardcoded rsync account, allowing remote attackers to read or write to arbitrary files via unspecified vectors.
Original NVD description (English source)
Fortinet FortiWLC 6.1-2-29 and earlier, 7.0-9-1, 7.0-10-0, 8.0-5-0, 8.1-2-0, and 8.2-4-0 allow administrators to obtain sensitive user credentials by reading the pam.log file.