CVE-2017-7738
HighSummary
CVE-2017-7738 is an Information Disclosure vulnerability in Fortinet FortiOS versions 5.6.0 to 5.6.2, 5.4.0 to 5.4.5, and 5.2 and below, allowing an admin user with super_admin privileges to view current SSL VPN web portal session info, which may contain user credentials.
Risk Assessment
The risk to the organization involves the potential exposure of user credentials, which could lead to unauthorized access to systems.
Recommendation
It is recommended to update FortiOS to the latest version to mitigate this vulnerability and to restrict access to the fnsysctl command for users with super_admin privileges.
Other vulnerabilities in Fortinet FortiOS
See all- CVE-2024-21762CriticalActively exploited
An out-of-bounds write in Fortinet FortiOS and FortiProxy allows an attacker to execute unauthorized code or commands via specifically crafted requests. Affects multiple versions of FortiOS and FortiProxy.
- CVE-2018-13374MediumActively exploited
An improper access control vulnerability in Fortinet FortiOS and FortiADC allows an attacker to obtain LDAP server login credentials configured in FortiGate by pointing a connectivity test to a rogue LDAP server.
- CVE-2025-67862Medium
Fortinet FortiOS and FortiProxy in multiple versions contain a vulnerability exposing an internal asset to an unsafe debug access level. This allows an authenticated admin to execute Lua scripts via crafted CLI commands.
- CVE-2025-53844High
An out-of-bounds write vulnerability in Fortinet FortiOS versions 7.6.0 through 7.6.3, 7.4.0 through 7.4.8, and 7.2.0 through 7.2.11 allows an attacker to execute unauthorized code or commands via specially crafted packets.
- CVE-2025-58413High
A stack-based buffer overflow vulnerability exists in Fortinet FortiOS versions 7.6.0 through 7.6.3, 7.4.0 through 7.4.8, and all versions of 7.2, 7.0, 6.4, 6.2, and 6.0. An attacker can execute unauthorized code or commands via specially crafted packets.
- CVE-2025-53843High
A stack-based buffer overflow vulnerability exists in Fortinet FortiOS versions 7.6.0 through 7.6.3, 7.4.0 through 7.4.8, and all versions of 7.2, 7.0, and 6.4. An attacker can exploit this vulnerability to execute unauthorized code or commands via specially crafted packets.
- CVE-2025-58903Low
CVE-2025-58903 in Fortinet FortiOS versions 7.6.0 through 7.6.3 and before 7.4.8 has an Unchecked Return Value vulnerability that allows an authenticated user to cause a Null Pointer Dereference, crashing the http daemon via a specially crafted request.
- CVE-2024-52963Low
An out-of-bounds write in Fortinet FortiOS versions 7.6.0, 7.4.0 through 7.4.6, 7.2.0 through 7.2.10, 7.0.0 through 7.0.16, and 6.4.0 through 6.4.15 allows an attacker to trigger a denial of service via specially crafted packets.
Original NVD description (English source)
An Information Disclosure vulnerability in Fortinet FortiOS 5.6.0 to 5.6.2, 5.4.0 to 5.4.5, 5.2 and below versions allow an admin user with super_admin privileges to view the current SSL VPN web portal session info which may contains user credentials through the fnsysctl CLI command.