vulnwire
8.8high

CVE-2016-4965

Fortinet FortiWan (formerly AscernLink) before 4.2.5 allows remote authenticated users with access to the nslookup functionality to execute…

Published 10 y ago · modified 4 mo ago · JSON

CVSS
8.8
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
4.1%
percentile 91%
Public exploits
0
none known

Fortinet FortiWan (formerly AscernLink) before 4.2.5 allows remote authenticated users with access to the nslookup functionality to execute arbitrary commands with root privileges via the graph parameter to diagnosis_control.php.

Exploit prediction (EPSS)

4.12% probability of exploitation in the next 30 days, higher than 91% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
NVD3.08.8CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD2.09.0AV:N/AC:L/Au:S/C:C/I:C/A:C

Classification

Weakness
  • CWE-78 Improper Neutralization of Special Elements used in an OS Command

References

  • securityfocus.com /bid/92779 · vdb-entry, x_refsource_BID, x_transferred
  • docs.fortinet.com /uploaded/files/3236/fortiwan-v4.2.5-release-notes.pdf · x_refsource_CONFIRM, x_transferred
  • kb.cert.org /vuls/id/724487 · third-party-advisory, x_refsource_CERT-VN, x_transferred
  • fortiguard.com /advisory/fortiwan-multiple-vulnerabilities · x_refsource_CONFIRM, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.