CVE-2017-7336: A hard-coded account named 'upgrade' in Fortinet FortiWLM 8.3.0 and lower versions allows a remote attacker to log-in and execute commands with 'upgrade'…

PriorityP262critical9.8CVSS 3.0

AVNACLPRNUINSUCHIHAH

EPSS

2.46%

82.5th percentile

A hard-coded account named 'upgrade' in Fortinet FortiWLM 8.3.0 and lower versions allows a remote attacker to log-in and execute commands with 'upgrade' account privileges.

Affected

4 ranges

Vendor	Product	Version range	Fixed in
fortinet	fortinet	—	—
fortinet	fortiwlm	<= 8.3.0	—
fortinet	fortiwlm	—	—
fortinet_inc	fortinet_fortiwlm	—	—

Detection & IOCsextracted from sources · hover to see the quote

otherupgrade↗

→Detect remote login attempts using the hard-coded username 'upgrade' against Fortinet FortiWLM devices (versions 8.3.0 and below). Any successful or attempted authentication with this account should be treated as malicious. ↗
→Monitor FortiWLM management interfaces for command execution sessions originating from the 'upgrade' account, as exploitation grants command execution privileges on the device. ↗

·The hard-coded 'upgrade' account is present in FortiWLM 8.3.0 and all lower versions. Versions above 8.3.0 should be verified to confirm the account has been removed. ↗
·This is a CWE-798 (Use of Hard-coded Credentials) vulnerability with a CVSS score of 9.8 (Critical), meaning no prior authentication or user interaction is required for exploitation — network-accessible FortiWLM instances are directly at risk. ↗

CVSS provenance

nvdv3.09.8CRITICALCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.