Vulnerability · Published Dec 19, 2024 · Assigned by fortinet

CVE-2021-26093

Medium 6.6

In plain English

A medium-severity security flaw in FortiWLC from Fortinet. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 5% of all known vulnerabilities).

Severity (CVSS 3.1)6.6Medium

Exploit odds (30 days)0.2%top 94.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

An access of uninitialized pointer (CWE-824) vulnerability in FortiWLC versions 8.6.0, 8.5.3 and earlier may allow a local and authenticated attacker to crash the access point being managed by the controller by executing a crafted CLI command.

Affected products (as reported)

Vendor	Product	Versions
Fortinet	FortiWLC	8.6.08.5.0 – through 8.5.38.4.4 – through 8.4.88.4.0 – through 8.4.28.3.0 – through 8.3.38.2.4 – through 8.2.78.1.2 – through 8.1.38.0.6

Weakness: CWE-824 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:H/E:P/RL:X/RC:R

References

https://fortiguard.com/psirt/FG-IR-21-002