CVE-2016-8491

moderate-risk

Published 2017-02-01

The presence of a hardcoded account named 'core' in Fortinet FortiWLC allows attackers to gain unauthorized read/write access via a remote shell.

Do I need to act?

0.27% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 9.1/10 Critical

NETWORK / LOW complexity

Fortiwlc

Fortinet

Third Party Advisory http://www.securityfocus.com/bid/94186

Vendor Advisory https://fortiguard.com/advisory/FG-IR-16-065

Third Party Advisory http://www.securityfocus.com/bid/94186

Vendor Advisory https://fortiguard.com/advisory/FG-IR-16-065

/ 100

moderate-risk

Severity 31/34 · Critical

Exploitability 1/34 · Minimal

Exposure 12/34 · Low