{"id":"CVE-2021-42758","state":"PUBLISHED","title":"An improper access control vulnerability [CWE-284] in FortiWLC 8.6.1 and below may allow an authenticated and remote attacker with low privileges to execute any command as an admin","description":"An improper access control vulnerability [CWE-284] in FortiWLC 8.6.1 and below may allow an authenticated and remote attacker with low privileges to execute any command as an admin user with full access rights via bypassing the GUI restrictions.","publishedAt":"2021-12-08T10:53:03.000Z","updatedAt":"2024-10-25T13:42:26.199Z","severity":{"score":8.8,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:U/RC:R","source":"fortinet"},"assigner":"fortinet","products":["Fortinet Fortinet FortiWLC"],"affected":[{"vendor":"Fortinet","product":"Fortinet FortiWLC","versions":[{"version":"FortiWLC 8.6.1 and below","status":"affected"}]}],"references":["https://fortiguard.com/advisory/FG-IR-21-200"],"weaknesses":[],"ingestedAt":"2026-10-29T19:49:04.473Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2021/42xxx/CVE-2021-42758.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2021-42758","state":"PUBLISHED","datePublished":"2021-12-08T10:53:03.000Z","dateUpdated":"2024-10-25T13:42:26.199Z","assignerShortName":"fortinet","assignerOrgId":"6abe59d8-c742-4dff-8ce8-9b0ca1073da8","dateReserved":"2021-10-20T00:00:00.000Z"},"containers":{"cna":{"descriptions":[{"lang":"en","value":"An improper access control vulnerability [CWE-284] in FortiWLC 8.6.1 and below may allow an authenticated and remote attacker with low privileges to execute any command as an admin user with full access rights via bypassing the GUI restrictions."}],"affected":[{"vendor":"Fortinet","product":"Fortinet FortiWLC","versions":[{"version":"FortiWLC 8.6.1 and below","status":"affected"}]}],"references":[{"url":"https://fortiguard.com/advisory/FG-IR-21-200","tags":["x_refsource_CONFIRM"]}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","exploitCodeMaturity":"PROOF_OF_CONCEPT","integrityImpact":"HIGH","privilegesRequired":"LOW","remediationLevel":"UNAVAILABLE","reportConfidence":"REASONABLE","scope":"UNCHANGED","temporalScore":8,"temporalSeverity":"HIGH","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:U/RC:R","version":"3.1"}}],"problemTypes":[{"descriptions":[{"description":"Improper access control","lang":"en","type":"text"}]}],"providerMetadata":{"shortName":"fortinet","dateUpdated":"2021-12-08T10:53:03.000Z","orgId":"6abe59d8-c742-4dff-8ce8-9b0ca1073da8"},"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"psirt@fortinet.com","ID":"CVE-2021-42758","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"Fortinet FortiWLC","version":{"version_data":[{"version_value":"FortiWLC 8.6.1 and below"}]}}]},"vendor_name":"Fortinet"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"An improper access control vulnerability [CWE-284] in FortiWLC 8.6.1 and below may allow an authenticated and remote attacker with low privileges to execute any command as an admin user with full access rights via bypassing the GUI restrictions."}]},"impact":{"cvss":{"attackComplexity":"Low","attackVector":"Network","availabilityImpact":"High","baseScore":8,"baseSeverity":"High","confidentialityImpact":"High","integrityImpact":"High","privilegesRequired":"Low","scope":"Unchanged","userInteraction":"None","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:U/RC:R","version":"3.1"}},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"Improper access control"}]}]},"references":{"reference_data":[{"name":"https://fortiguard.com/advisory/FG-IR-21-200","refsource":"CONFIRM","url":"https://fortiguard.com/advisory/FG-IR-21-200"}]}}},"adp":[{"title":"CVE Program Container","references":[{"url":"https://fortiguard.com/advisory/FG-IR-21-200","tags":["x_refsource_CONFIRM","x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-04T03:38:50.213Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2024-10-23T14:13:15.441432Z","id":"CVE-2021-42758","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2024-10-25T13:42:26.199Z"}}]}}}