CVE-2016-8491
CriticalSummary
The presence of a hardcoded account named 'core' in Fortinet FortiWLC allows attackers to gain unauthorized read/write access via a remote shell.
Risk Assessment
The organization may be exposed to unauthorized access to the system, potentially leading to data leakage or modification of critical settings.
Recommendation
It is recommended to remove or disable the hardcoded 'core' account and implement strong authentication mechanisms.
Other vulnerabilities in Fortinet FortiWLC
See all- CVE-2016-7561High
Fortinet FortiWLC versions 6.1-2-29 and earlier, 7.0-9-1, 7.0-10-0, 8.0-5-0, 8.1-2-0, and 8.2-4-0 allow administrators to obtain sensitive user credentials by reading the pam.log file.
- CVE-2016-7560Critical
The rsyncd server in Fortinet FortiWLC versions 6.1-2-29 and earlier, 7.0-9-1, 7.0-10-0, 8.0-5-0, 8.1-2-0, and 8.2-4-0 has a hardcoded rsync account, allowing remote attackers to read or write to arbitrary files via unspecified vectors.
Original NVD description (English source)
The presence of a hardcoded account named 'core' in Fortinet FortiWLC allows attackers to gain unauthorized read/write access via a remote shell.