CVE-2021-26114

published 2022-04-06

CVE-2021-26114: Multiple improper neutralization of special elements used in an SQL command vulnerabilities in FortiWAN before 4.5.9 may allow an unauthenticated attacker to…

Priority P2 62 critical 9.8 CVSS 3.1

AV N AC L PR N UI N S U C H I H A H

Multiple improper neutralization of special elements used in an SQL command vulnerabilities in FortiWAN before 4.5.9 may allow an unauthenticated attacker to execute unauthorized code or commands via specifically crafted HTTP requests.

Affected

3 ranges

Vendor	Product	Version range	Fixed in
fortinet	fortinet_fortiwan	—	—
fortinet	fortiwan	<= 4.5.8	—
fortinet	fortiwan	—	—

Detection & IOCs extracted from sources · hover to see the quote

• → Unauthenticated SQL injection via crafted HTTP requests targeting FortiWAN; monitor for anomalous or malformed HTTP requests to FortiWAN management interfaces that contain SQL metacharacters or injection payloads ↗

• · Vulnerability affects FortiWAN versions prior to 4.5.9; ensure patching to 4.5.9 or later to remediate all SQL injection vectors described under CWE-89 ↗

CVSS provenance

nvd v3.1 9.8 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

nvd v2.0 7.5 HIGH AV:N/AC:L/Au:N/C:P/I:P/A:P

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-89