CVE-2016-4965

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Fortinet FortiWan (formerly AscernLink) before 4.2.5 allows remote authenticated users with access to the nslookup functionality to execute arbitrary commands with root privileges via the graph parameter to diagnosis_control.php.

Metrics

CVSS 3.0 8.8/10CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://docs.fortinet.com/uploaded/files/3236/fortiwan-v4.2.5-release-notes.pdfRelease Notes
http://fortiguard.com/advisory/fortiwan-multiple-vulnerabilitiesVendor Advisory
http://www.securityfocus.com/bid/92779Third Party Advisory, VDB Entry
https://www.kb.cert.org/vuls/id/724487Third Party Advisory, US Government Resource
http://docs.fortinet.com/uploaded/files/3236/fortiwan-v4.2.5-release-notes.pdfRelease Notes
http://fortiguard.com/advisory/fortiwan-multiple-vulnerabilitiesVendor Advisory
http://www.securityfocus.com/bid/92779Third Party Advisory, VDB Entry
https://www.kb.cert.org/vuls/id/724487Third Party Advisory, US Government Resource

Timeline

Published: Sep 21, 2016
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2016

CVE-2016-49666.5The diagnosis_control.php page in Fortinet FortiWan (formerly AscernLink) before 4.2.5 allows remote authenticated users to download PCAP fi CVE-2016-49676.5Fortinet FortiWan (formerly AscernLink) before 4.2.5 allows remote authenticated users to obtain sensitive information from (1) a backup of CVE-2016-49686.5The linkreport/tmp/admin_global page in Fortinet FortiWan (formerly AscernLink) before 4.2.5 allows remote authenticated users to discover a CVE-2016-49696.1Cross-site scripting (XSS) vulnerability in Fortinet FortiWan (formerly AscernLink) before 4.2.5 allows remote attackers to inject arbitrary CVE-2016-49707.5handler/ssl/OpenSslEngine.java in Netty 4.0.x before 4.0.37.Final and 4.1.x before 4.1.1.Final allows remote attackers to cause a denial of CVE-2016-49718.8GNU wget before 1.18 allows remote servers to write to arbitrary files by redirecting a request from HTTP to a crafted FTP resource.CVE-2016-49729.8OpenStack Murano before 1.0.3 (liberty) and 2.x before 2.0.1 (mitaka), Murano-dashboard before 1.0.3 (liberty) and 2.x before 2.0.1 (mitaka)CVE-2016-49737.8Binaries compiled against targets that use the libssp library in GCC for stack smashing protection (SSP) might allow local users to perform CVE-2016-49747.5Apache Qpid AMQP 0-x JMS client before 6.0.4 and JMS (AMQP 1.0) before 0.10.0 does not restrict the use of classes available on the classpat CVE-2016-49756.1Possible CRLF injection allowing HTTP response splitting attacks for sites which use mod_userdir. This issue was mitigated by changes made i CVE-2016-49765.5Apache Ambari 2.x before 2.4.0 includes KDC administrator passwords on the kadmin command line, which allows local users to obtain sensitive CVE-2016-49778.8When processing authorization requests using the whitelabel views in Spring Security OAuth 2.0.0 to 2.0.9 and 1.0.0 to 1.0.5, the response_t