CVE-2023-33299

Summary

A deserialization of untrusted data in Fortinet FortiNAC below 7.2.1, below 9.4.3, below 9.2.8 and all earlier versions of 8.x allows attacker to execute unauthorized code or commands via specifically crafted request on inter-server communication port. Note FortiNAC versions 8.x will not be fixed.

Affected Software

VendorProductVersion RangeStatus
FortinetFortiNAC9.4.0 <= 9.4.2affected
FortinetFortiNAC9.2.0 <= 9.2.7affected
FortinetFortiNAC9.1.0 <= 9.1.9affected
FortinetFortiNAC8.8.0 <= 8.8.11affected
FortinetFortiNAC8.7.0 <= 8.7.6affected
FortinetFortiNAC8.6.0 <= 8.6.5affected
FortinetFortiNAC8.5.0 <= 8.5.4affected
FortinetFortiNAC8.3.7affected
FortinetFortiNAC7.2.0 <= 7.2.1affected

Weaknesses

  • CWE-502: Execute unauthorized code or commands

ADP Enrichment

CVE Program Container

Additional References

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: yes
    • Technical Impact: total

References