Common Vulnerabilities and Exposures

This release of FortiWLC is no longer vulnerable to the following:

CWE/Tracking ID	Description
CWE-657	Violation of Secure Design Principles
CVE-2020-24586	Fragmentation cache not cleared on reconnection
CVE-2020-24587	Reassembling fragments encrypted under different keys
CVE-2020-24588	Accepting non-SPP A-MSDU frames, which leads to payload being parsed as an L2 frame under an A-MSDU bit toggling attack
CVE-2021-42759	Unrestricted execution of OS commands as root.

This release of FortiWLC is no longer vulnerable to the following:

CWE/Tracking ID

Description

CWE-657

Violation of Secure Design Principles

CVE-2020-24586

Fragmentation cache not cleared on reconnection

CVE-2020-24587

Reassembling fragments encrypted under different keys

CVE-2020-24588

Accepting non-SPP A-MSDU frames, which leads to payload being parsed as an L2 frame under an A-MSDU bit toggling attack

CVE-2021-42759

Unrestricted execution of OS commands as root.