CVE-2021-26102

The attacker sends a specially crafted HTTP POST request containing a relative path sequence (relative path traversal, CWE-23), thereby bypassing authentication and access control mechanisms (CWE-305). The vulnerability allows operating on arbitrary files outside the permitted directory. Deletion of specific configuration files causes the administrator account password to reset to a default value, opening full access to the device.

An attacker without any privileges can delete critical system files and reset the administrator password to a default value, which in practice leads to complete takeover of the FortiWAN device.

FortiWAN should be updated to a version higher than 4.5.7. Detailed information about available patches is available in the vendor's guide at https://fortiguard.fortinet.com/psirt/FG-IR-21-048. Until the update is applied, it is recommended to restrict access to the device management interface only to trusted networks and IP addresses.

Fortinet FortiWAN version 4.5.7 and earlier, as well as all versions of the 4.4 branch