An incorrect privilege assignment vulnerability [CWE-266] in FortiOS Security Fabric version 7.6.0 through 7.6.2, 7.4.0 through 7.4.7, 7.2 all versions, 7.0 all versions, 6.4 all versions, may allow a remote authenticated attacker with high privileges to escalate their privileges to super-admin via registering the device to a malicious FortiManager.
Problem Types
| Type | CWE ID | Description |
|---|
| CWE | CWE-266 | Escalation of privilege |
Type: CWE
Description: Escalation of privilege
Metrics
| Version | Base score | Base severity | Vector |
|---|
| 3.1 | 6.8 | MEDIUM | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:C |
Version: 3.1
Base score: 6.8
Base severity: MEDIUM
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:C