UpHeron
All vulnerabilities

Servers and applications

CVE-2016-7542

A read-only administrator on Fortinet devices with FortiOS 5.2.x before 5.2.10 GA and 5.4.x before 5.4.2 GA may have access to read-write administrators password hashes (not including super-admins) stored on the appliance via the webui REST API, and may therefore be able to crack them.

Severity
Medium 4.9
Published
30 Mar 2017
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Exploit chance
1.5% in the next 30 daysHigher than 75% of CVEs. EPSS by FIRST, 11 Nov 2026
Weakness
Information exposure (CWE-200)
Attack
Over the network · Needs an administrator account · No user action needed
Attacker can
Read data
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Sources
NVD

Affected software

SoftwareAffected versions
Fortinet FortiOSServers and applications · cpe:o:fortinet:fortios
  • Version 5.4.1
  • Version 5.4.0
  • Version 5.2.9
  • Version 5.2.8
All 12 release lines
  • Version 5.2.0
  • Version 5.2.1
  • Version 5.2.2
  • Version 5.2.3
  • Version 5.2.4
  • Version 5.2.5
  • Version 5.2.6
  • Version 5.2.7
  • Version 5.2.8
  • Version 5.2.9
  • Version 5.4.0
  • Version 5.4.1

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2016-7542
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2016-7542