Hard-Coded Password Vulnerability in Fortinet Wireless Controllers

CVE-2021-22126

What is CVE-2021-22126?

The Fortinet Wireless Controllers, specifically FortiWLC versions 8.5.2 and below, 8.4.8 and below, 8.3.3 to 8.3.2, and 8.2.7 to 8.2.6, contain a critical flaw due to hard-coded passwords. This vulnerability enables local, authenticated users to gain root access to the managed Access Points, namely Meru AP and FortiAP-U, bypassing authentication controls. Without changing default credentials, attackers could exploit this weakness to potentially compromise network integrity and sensitive information.

References