CVE-2021-26102 - Vulnerability Details - OpenCVE

A relative path traversal vulnerability (CWE-23) in FortiWAN version 4.5.7 and below, 4.4 all versions may allow a remote non-authenticated attacker to delete files on the system by sending a crafted POST request. In particular, deleting specific configuration files will reset the Admin password to its default value.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable yes

Technical Impact total

Vendors	Products
Fortinet	Fortiwan

Configuration 1 [-]

cpe:2.3:a:fortinet:fortiwan:*:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://fortiguard.fortinet.com/psirt/FG-IR-21-048

History

Tue, 15 Jul 2025 13:45:00 +0000

Type	Values Removed	Values Added
Metrics	epss `{'score': 0.11353}`	epss `{'score': 0.1258}`

Tue, 21 Jan 2025 20:45:00 +0000

Type	Values Removed	Values Added
First Time appeared		Fortinet Fortinet fortiwan
Weaknesses		CWE-22
CPEs		cpe:2.3:a:fortinet:fortiwan::::::::
Vendors & Products		Fortinet Fortinet fortiwan

Thu, 19 Dec 2024 16:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Thu, 19 Dec 2024 14:00:00 +0000

Type	Values Removed	Values Added
Description		A relative path traversal vulnerability (CWE-23) in FortiWAN version 4.5.7 and below, 4.4 all versions may allow a remote non-authenticated attacker to delete files on the system by sending a crafted POST request. In particular, deleting specific configuration files will reset the Admin password to its default value.
Weaknesses		CWE-305
References		https://fortiguard.fortinet.com/psirt/FG-IR-21-048
Metrics		cvssV3_1 `{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H/RL:U/RC:C'}`

MITRE

Status: PUBLISHED

Assigner: fortinet

Published: 2024-12-19T13:56:38.177Z

Updated: 2024-12-19T15:17:08.639Z

Reserved: 2021-01-25T14:47:15.095Z

Link: CVE-2021-26102

Vulnrichment

Updated: 2024-12-19T15:16:21.331Z

NVD

Status : Analyzed

Published: 2024-12-19T14:15:05.380

Modified: 2025-01-21T20:29:43.850

Link: CVE-2021-26102

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2021-26102", "assignerOrgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", "state": "PUBLISHED", "assignerShortName": "fortinet", "dateReserved": "2021-01-25T14:47:15.095Z", "datePublished": "2024-12-19T13:56:38.177Z", "dateUpdated": "2024-12-19T15:17:08.639Z"}, "containers": {"cna": {"affected": [{"vendor": "Fortinet", "product": "FortiWAN", "cpes": [], "defaultStatus": "unaffected", "versions": [{"versionType": "semver", "version": "4.5.0", "lessThanOrEqual": "4.5.7", "status": "affected"}, {"versionType": "semver", "version": "4.4.0", "lessThanOrEqual": "4.4.1", "status": "affected"}]}], "descriptions": [{"lang": "en", "value": "A relative path traversal vulnerability (CWE-23) in FortiWAN version 4.5.7 and below, 4.4 all versions may allow a remote non-authenticated attacker to delete files on the system by sending a crafted POST request. In particular, deleting specific configuration files will reset the Admin password to its default value."}], "providerMetadata": {"orgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", "shortName": "fortinet", "dateUpdated": "2024-12-19T13:56:38.177Z"}, "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-305", "description": "Improper access control", "type": "CWE"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"version": "3.1", "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H/RL:U/RC:C"}}], "solutions": [{"lang": "en", "value": "Please upgrade to FortiWAN version 4.5.8 or above \nPlease upgrade to AscenLink version 7.2.24 or above"}], "references": [{"name": "https://fortiguard.fortinet.com/psirt/FG-IR-21-048", "url": "https://fortiguard.fortinet.com/psirt/FG-IR-21-048"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-12-19T15:14:52.995354Z", "id": "CVE-2021-26102", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-12-19T15:17:08.639Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2021-26102", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-12-19T15:14:52.995354Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-12-19T15:16:21.331Z"}}], "cna": {"metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H/RL:U/RC:C", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"cpes": [], "vendor": "Fortinet", "product": "FortiWAN", "versions": [{"status": "affected", "version": "4.5.0", "versionType": "semver", "lessThanOrEqual": "4.5.7"}, {"status": "affected", "version": "4.4.0", "versionType": "semver", "lessThanOrEqual": "4.4.1"}], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "Please upgrade to FortiWAN version 4.5.8 or above \nPlease upgrade to AscenLink version 7.2.24 or above"}], "references": [{"url": "https://fortiguard.fortinet.com/psirt/FG-IR-21-048", "name": "https://fortiguard.fortinet.com/psirt/FG-IR-21-048"}], "descriptions": [{"lang": "en", "value": "A relative path traversal vulnerability (CWE-23) in FortiWAN version 4.5.7 and below, 4.4 all versions may allow a remote non-authenticated attacker to delete files on the system by sending a crafted POST request. In particular, deleting specific configuration files will reset the Admin password to its default value."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-305", "description": "Improper access control"}]}], "providerMetadata": {"orgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", "shortName": "fortinet", "dateUpdated": "2024-12-19T13:56:38.177Z"}}}, "cveMetadata": {"cveId": "CVE-2021-26102", "state": "PUBLISHED", "dateUpdated": "2024-12-19T15:17:08.639Z", "dateReserved": "2021-01-25T14:47:15.095Z", "assignerOrgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", "datePublished": "2024-12-19T13:56:38.177Z", "assignerShortName": "fortinet"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:fortinet:fortiwan:*:*:*:*:*:*:*:*", "matchCriteriaId": "C177EBEF-63F1-47E4-9DBB-5424C6AFCB5A", "versionEndExcluding": "4.5.8", "versionStartIncluding": "4.4.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A relative path traversal vulnerability (CWE-23) in FortiWAN version 4.5.7 and below, 4.4 all versions may allow a remote non-authenticated attacker to delete files on the system by sending a crafted POST request. In particular, deleting specific configuration files will reset the Admin password to its default value."}, {"lang": "es", "value": "Una vulnerabilidad de path traversal relativo (CWE-23) en FortiWAN versi\u00f3n 4.5.7 y anteriores, 4.4 y todas las versiones puede permitir que un atacante remoto no autenticado elimine archivos del sistema mediante el env\u00edo de una solicitud POST manipulada. En particular, la eliminaci\u00f3n de archivos de configuraci\u00f3n espec\u00edficos restablecer\u00e1 la contrase\u00f1a de administrador a su valor predeterminado."}], "id": "CVE-2021-26102", "lastModified": "2025-01-21T20:29:43.850", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "psirt@fortinet.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.2, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2024-12-19T14:15:05.380", "references": [{"source": "psirt@fortinet.com", "tags": ["Vendor Advisory"], "url": "https://fortiguard.fortinet.com/psirt/FG-IR-21-048"}], "sourceIdentifier": "psirt@fortinet.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-305"}], "source": "psirt@fortinet.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-22"}], "source": "nvd@nist.gov", "type": "Primary"}]}