FortiWAN Path Traversal Vulnerability in File Deletion
CVE-2021-26102 Published on December 19, 2024
A relative path traversal vulnerability (CWE-23) in FortiWAN version 4.5.7 and below, 4.4 all versions may allow a remote non-authenticated attacker to delete files on the system by sending a crafted POST request. In particular, deleting specific configuration files will reset the Admin password to its default value.
Vulnerability Analysis
CVE-2021-26102 is exploitable with network access, and does not require authorization privileges or user interaction. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to be critical as this vulnerability has a high impact to the confidentiality, integrity and availability of this component.
Weakness Type
Authentication Bypass by Primary Weakness
The authentication algorithm is sound, but the implemented mechanism can be bypassed as the result of a separate weakness that is primary to the authentication error.
Products Associated with CVE-2021-26102
You can be notified by email with stack.watch whenever vulnerabilities like CVE-2021-26102 are published in Fortinet Fortiwan:
Affected Versions
Fortinet FortiWAN:- Version 4.5.0, <= 4.5.7 is affected.
- Version 4.4.0, <= 4.4.1 is affected.
Exploit Probability
EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.