Fortinet Fortiwan vulnerabilities

CVE-2021-26114 [CRITICAL] CWE-89 CVE-2021-26114: Multiple improper neutralization of special elements used in an SQL command vulnerabilities in Forti Multiple improper neutralization of special elements used in an SQL command vulnerabilities in FortiWAN before 4.5.9 may allow an unauthenticated attacker to execute unauthorized code or commands via specifically crafted HTTP requests.

CVE-2021-26112 [HIGH] CWE-787 CVE-2021-26112: Multiple stack-based buffer overflow vulnerabilities [CWE-121] both in network daemons and in the co Multiple stack-based buffer overflow vulnerabilities [CWE-121] both in network daemons and in the command line interpreter of FortiWAN before 4.5.9 may allow an unauthenticated attacker to potentially corrupt control data in memory and execute arbitrary code via specifically crafted requests.

CVE-2021-26113 [MEDIUM] CWE-916 CVE-2021-26113: A use of a one-way hash with a predictable salt vulnerability [CWE-760] in FortiWAN before 4.5.9 may A use of a one-way hash with a predictable salt vulnerability [CWE-760] in FortiWAN before 4.5.9 may allow an attacker who has previously come in possession of the password file to potentially guess passwords therein stored.

CVE-2021-24009 [HIGH] CWE-78 CVE-2021-24009: Multiple improper neutralization of special elements used in an OS command vulnerabilities (CWE-78) Multiple improper neutralization of special elements used in an OS command vulnerabilities (CWE-78) in the Web GUI of FortiWAN before 4.5.9 may allow an authenticated attacker to execute arbitrary commands on the underlying system's shell via specifically crafted HTTP requests.

CVE-2021-32593 [MEDIUM] CWE-327 CVE-2021-32593: A use of a broken or risky cryptographic algorithm vulnerability [CWE-327] in the Dynamic Tunnel Pro A use of a broken or risky cryptographic algorithm vulnerability [CWE-327] in the Dynamic Tunnel Protocol of FortiWAN before 4.5.9 may allow an unauthenticated remote attacker to decrypt and forge protocol communication messages.

CVE-2021-32585 [HIGH] CWE-79 CVE-2021-32585: An improper neutralization of input during web page generation vulnerability [CWE-79] in FortiWAN be An improper neutralization of input during web page generation vulnerability [CWE-79] in FortiWAN before 4.5.9 may allow an attacker to perform a stored cross-site scripting attack via specifically crafted HTTP requests.