CVE-2017-7738

Severity: high (CVSS 7.2 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2017-12-13 · updated 2026-06-17
Weakness: CWE-200

Description

An Information Disclosure vulnerability in Fortinet FortiOS 5.6.0 to 5.6.2, 5.4.0 to 5.4.5, 5.2 and below versions allow an admin user with super_admin privileges to view the current SSL VPN web portal session info which may contains user credentials through the fnsysctl CLI command.

Affected products

Fortinet FortiOS (FortiGate): through 5.2; from 5.4.0 through 5.4.5; from 5.6.0 through 5.6.2

References

http://www.securityfocus.com/bid/102151
https://fortiguard.com/advisory/FG-IR-17-172
http://www.securityfocus.com/bid/102151
https://fortiguard.com/advisory/FG-IR-17-172

Get alerted when CVE-2017-7738 or the next vulnerability affects your stack