/usr/sbin/default.sh and /usr/apache/htdocs/cgi-bin/admin/hardfactorydefault.cgi on Dynacolor FCM-MB40 v1.2.0.0 devices implement an incomplete factory-reset process. A backdoor can persist because neither system accounts nor the set of services is reset.
CVSS Vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HFortinet Fcm Mb40
HWFortinetall versionsFortinet Fcm Mb40 Firmware
OSFortinet1.2.0.0
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
CWE
Related vulnerabilities
CVE-2019-13400CRITICAL9.8PL ✓same product
Fortinet FCM-MB40: dane logowania przechowywane w postaci jawnej
CVE-2019-13398HIGH7.2same product
Dynacolor FCM-MB40 v1.2.0.0 devices allow remote attackers to execute arbitrary commands via a crafted paramet...
CVE-2019-13401HIGH8.8same product
Dynacolor FCM-MB40 v1.2.0.0 devices have CSRF in all scripts under cgi-bin/.
CVE-2019-13399MEDIUM5.9same product
Dynacolor FCM-MB40 v1.2.0.0 devices have a hard-coded SSL/TLS key that is used during an administrator's SSL c...
CVE-2026-25089CRITICAL9.8⚠ KEVPL ✓same vendor
Command injection w Fortinet FortiSandbox — dostęp bez uwierzytelnienia