Fortinet Fortiwlc
Don't miss out!
Thousands of developers use stack.watch to stay informed.Get an email whenever new security vulnerabilities are reported in Fortinet Fortiwlc.
By the Year
In 2026 there have been 0 vulnerabilities in Fortinet Fortiwlc. Last year, in 2025 Fortiwlc had 4 security vulnerabilities published. Right now, Fortiwlc is on track to have less security vulnerabilities in 2026 than it did last year.
| Year | Vulnerabilities | Average Score |
|---|---|---|
| 2026 | 0 | 0.00 |
| 2025 | 4 | 5.10 |
| 2024 | 1 | 6.50 |
| 2023 | 0 | 0.00 |
| 2022 | 0 | 0.00 |
| 2021 | 1 | 8.80 |
| 2020 | 1 | 0.00 |
| 2019 | 0 | 0.00 |
| 2018 | 2 | 0.00 |
It may take a day or so for new Fortiwlc vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.
Recent Fortinet Fortiwlc Security Vulnerabilities
FortiWLC 8.6.0 Unauth Remote CGI Access Control Flaw
CVE-2021-32584
- March 17, 2025
An improper access control (CWE-284) vulnerability in FortiWLC version 8.6.0, version 8.5.3 and below, version 8.4.8 and below, version 8.3.3 and below, version 8.2.7 to 8.2.4, version 8.1.3 may allow an unauthenticated and remote attacker to access certain areas of the web management CGI functionality by just specifying the correct URL. The vulnerability applies only to limited CGI resources and might allow the unauthorized party to access configuration details.
Authorization
FortiWLC <=8.6.0/8.5.3/8.4.8/8.3.3 Stored XSS via Web Interface
CVE-2021-26087
6.1 - Medium
- March 17, 2025
An improper neutralization of input during web page generation in FortiWLC version 8.6.0, version 8.5.3 and below, version 8.4.8 and below, version 8.3.3 web interface may allow both authenticated remote attackers and non-authenticated attackers in the same network as the appliance to perform a stored cross site scripting attack (XSS) via injecting malicious payloads in different locations.
XSS
Use of Hard-Coded Password in FortiWLC 8.5.2 & Earlier (Local Auth Root Access)
CVE-2021-22126
- March 17, 2025
A use of hard-coded password vulnerability in FortiWLC version 8.5.2 and below, version 8.4.8 and below, version 8.3.3 to 8.3.2, version 8.2.7 to 8.2.6 may allow a local, authenticated attacker to connect to the managed Access Point (Meru AP and FortiAP-U) as root using the default hard-coded username and password.
Use of Hard-coded Credentials
Fortinet FortiManager/<others> <=7.4.3 Cache Poison via External Host Header
CVE-2022-23439
4.1 - Medium
- January 22, 2025
A externally controlled reference to a resource in another sphere vulnerability in Fortinet allows attacker to poison web caches via crafted HTTP requests, where the `Host` header points to an arbitrary webserver
Externally Controlled Reference to a Resource in Another Sphere
Fortinet FortiWLC Access Point Uninitialized Pointer Access Vulnerability
CVE-2021-26093
6.5 - Medium
- December 19, 2024
An access of uninitialized pointer (CWE-824) vulnerability in FortiWLC versions 8.6.0, 8.5.3 and earlier may allow a local and authenticated attacker to crash the access point being managed by the controller by executing a crafted CLI command.
Access of Uninitialized Pointer
An improper access control vulnerability [CWE-284] in FortiWLC 8.6.1 and below may
CVE-2021-42758
8.8 - High
- December 08, 2021
An improper access control vulnerability [CWE-284] in FortiWLC 8.6.1 and below may allow an authenticated and remote attacker with low privileges to execute any command as an admin user with full access rights via bypassing the GUI restrictions.
AuthZ
An improper neutralization of input vulnerability in FortiWLC 8.5.1
CVE-2020-9288
- June 22, 2020
An improper neutralization of input vulnerability in FortiWLC 8.5.1 allows a remote authenticated attacker to perform a stored cross site scripting attack (XSS) via the ESS profile or the Radius Profile.
The presence of a hardcoded account in Fortinet FortiWLC 7.0.11 and earlier
CVE-2017-17539
- May 07, 2018
The presence of a hardcoded account in Fortinet FortiWLC 7.0.11 and earlier allows attackers to gain unauthorized read/write access via a remote shell.
The presence of a hardcoded account in Fortinet FortiWLC 8.3.3
CVE-2017-17540
- May 07, 2018
The presence of a hardcoded account in Fortinet FortiWLC 8.3.3 allows attackers to gain unauthorized read/write access via a remote shell.
Stay on top of Security Vulnerabilities
Want an email whenever new vulnerabilities are published for Fortinet Fortiwlc or by Fortinet? Click the Watch button to subscribe.
