Sign-up

ID

VAR-202105-1518


CVE

CVE-2021-22126


TITLE

fortinet's  FortiWLC  access control vulnerabilities in

Trust: 0.8

sources: JVNDB: JVNDB-2021-021881

DESCRIPTION

A use of hard-coded password vulnerability in FortiWLC version 8.5.2 and below, version 8.4.8 and below, version 8.3.3 to 8.3.2, version 8.2.7 to 8.2.6 may allow a local, authenticated attacker to connect to the managed Access Point (Meru AP and FortiAP-U) as root using the default hard-coded username and password. fortinet's FortiWLC contains vulnerabilities related to access control and the use of hard-coded credentials.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. Pillow is a Python-based image processing library. There is currently no information about this vulnerability, please feel free to follow CNNVD or manufacturer announcements

Trust: 2.16

sources: NVD: CVE-2021-22126 // JVNDB: JVNDB-2021-021881 // CNNVD: CNNVD-202104-975

AFFECTED PRODUCTS

vendor:fortinetmodel:fortiwlcscope:eqversion:8.3.2

Trust: 1.0

vendor:fortinetmodel:fortiwlcscope:gteversion:8.4.0

Trust: 1.0

vendor:fortinetmodel:fortiwlcscope:eqversion:8.2.6

Trust: 1.0

vendor:fortinetmodel:fortiwlcscope:eqversion:8.3.3

Trust: 1.0

vendor:fortinetmodel:fortiwlcscope:eqversion:8.2.7

Trust: 1.0

vendor:fortinetmodel:fortiwlcscope:ltversion:8.5.3

Trust: 1.0

vendor:フォーティネットmodel:fortiwlcscope:eqversion: -

Trust: 0.8

vendor:フォーティネットmodel:fortiwlcscope:eqversion:8.2.7

Trust: 0.8

vendor:フォーティネットmodel:fortiwlcscope:eqversion:8.4.0 that's all 8.5.3

Trust: 0.8

vendor:フォーティネットmodel:fortiwlcscope:eqversion:8.2.6

Trust: 0.8

vendor:フォーティネットmodel:fortiwlcscope:eqversion:8.3.2

Trust: 0.8

vendor:フォーティネットmodel:fortiwlcscope:eqversion:8.3.3

Trust: 0.8

sources: JVNDB: JVNDB-2021-021881 // NVD: CVE-2021-22126

CVSS

SEVERITY

CVSSV2

CVSSV3

psirt@fortinet.com: CVE-2021-22126
value: MEDIUM

Trust: 1.0

OTHER: JVNDB-2021-021881
value: MEDIUM

Trust: 0.8

CNNVD: CNNVD-202104-975
value: MEDIUM

Trust: 0.6

CNNVD: CNNVD-202105-185
value: HIGH

Trust: 0.6

psirt@fortinet.com: CVE-2021-22126
baseSeverity: MEDIUM
baseScore: 6.7
vectorString: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: HIGH
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 0.8
impactScore: 5.9
version: 3.1

Trust: 1.0

OTHER: JVNDB-2021-021881
baseSeverity: MEDIUM
baseScore: 6.7
vectorString: CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: HIGH
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: JVNDB: JVNDB-2021-021881 // CNNVD: CNNVD-202104-975 // CNNVD: CNNVD-202105-185 // NVD: CVE-2021-22126

PROBLEMTYPE DATA

problemtype:CWE-798

Trust: 1.0

problemtype:CWE-284

Trust: 1.0

problemtype:Inappropriate access control (CWE-284) [ others ]

Trust: 0.8

problemtype: Use hard-coded credentials (CWE-798) [NVD evaluation ]

Trust: 0.8

sources: JVNDB: JVNDB-2021-021881 // NVD: CVE-2021-22126

TYPE

other

Trust: 0.6

sources: CNNVD: CNNVD-202104-975

PATCH

title:FG-IR-20-147url:https://fortiguard.com/psirt/FG-IR-20-147

Trust: 0.8

title:4Gon Meru Networks Access Points Repair measures for trust management problem vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=149215

Trust: 0.6

sources: JVNDB: JVNDB-2021-021881 // CNNVD: CNNVD-202105-185

EXTERNAL IDS

db:NVDid:CVE-2021-22126

Trust: 3.2

db:JVNDBid:JVNDB-2021-021881

Trust: 0.8

db:CS-HELPid:SB2021041363

Trust: 0.6

db:CNNVDid:CNNVD-202104-975

Trust: 0.6

db:AUSCERTid:ESB-2021.1509

Trust: 0.6

db:CS-HELPid:SB2021050507

Trust: 0.6

db:CNNVDid:CNNVD-202105-185

Trust: 0.6

sources: JVNDB: JVNDB-2021-021881 // CNNVD: CNNVD-202104-975 // CNNVD: CNNVD-202105-185 // NVD: CVE-2021-22126

REFERENCES

url:https://fortiguard.fortinet.com/psirt/fg-ir-20-147

Trust: 1.0

url:https://nvd.nist.gov/vuln/detail/cve-2021-22126

Trust: 0.8

url:https://www.cybersecurity-help.cz/vdb/sb2021041363

Trust: 0.6

url:https://www.auscert.org.au/bulletins/esb-2021.1509

Trust: 0.6

url:https://www.cybersecurity-help.cz/vdb/sb2021050507

Trust: 0.6

sources: JVNDB: JVNDB-2021-021881 // CNNVD: CNNVD-202104-975 // CNNVD: CNNVD-202105-185 // NVD: CVE-2021-22126

SOURCES

db:JVNDBid:JVNDB-2021-021881
db:CNNVDid:CNNVD-202104-975
db:CNNVDid:CNNVD-202105-185
db:NVDid:CVE-2021-22126

LAST UPDATE DATE

2025-08-02T21:32:32.616000+00:00


SOURCES UPDATE DATE

db:JVNDBid:JVNDB-2021-021881date:2025-07-30T02:52:00
db:CNNVDid:CNNVD-202104-975date:2021-04-14T00:00:00
db:CNNVDid:CNNVD-202105-185date:2021-05-11T00:00:00
db:NVDid:CVE-2021-22126date:2025-07-24T20:16:08.390

SOURCES RELEASE DATE

db:JVNDBid:JVNDB-2021-021881date:2025-07-30T00:00:00
db:CNNVDid:CNNVD-202104-975date:2021-04-13T00:00:00
db:CNNVDid:CNNVD-202105-185date:2021-05-05T00:00:00
db:NVDid:CVE-2021-22126date:2025-03-17T14:15:17.067