CVE-2022-26117
8.8
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R
Summary
An empty password in configuration file vulnerability [CWE-258] in FortiNAC version 8.3.7 and below, 8.5.2 and below, 8.5.4, 8.6.0, 8.6.5 and below, 8.7.6 and below, 8.8.11 and below, 9.1.5 and below, 9.2.3 and below may allow an authenticated attacker to access the MySQL databases via the CLI.
Affected Software
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Fortinet | Fortinet FortiNAC | FortiNAC version 8.3.7 and below, 8.5.2 and below, 8.5.4, 8.6.0, 8.6.5 and below, 8.7.6 and below, 8.8.11 and below, 9.1.5 and below, 9.2.3 and below. | affected |
Weaknesses
- Execute unauthorized code or commands
ADP Enrichment
CVE Program Container
Additional References
- https://github.com/orangecertcc/security-research/security/advisories/GHSA-r259-5p5p-2q47
- https://fortiguard.com/psirt/FG-IR-22-058
CISA ADP Vulnrichment
- SSVC:
- Exploitation: none
- Automatable: no
- Technical Impact: total
References
- https://github.com/orangecertcc/security-research/security/advisories/GHSA-r259-5p5p-2q47
- https://fortiguard.com/psirt/FG-IR-22-058
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.