CVEvulnerability

CVE-2023-33299

9.8 CRITICAL Published 2023-06-23 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2023-06-23
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 3.1 ([email protected])
9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-502

Description

A deserialization of untrusted data in Fortinet FortiNAC below 7.2.1, below 9.4.3, below 9.2.8 and all earlier versions of 8.x allows attacker to execute unauthorized code or commands via specifically crafted request on inter-server communication port. Note FortiNAC versions 8.x will not be fixed.

Affected configurations

• fortinet fortinac (>= 8.5.0 <= 8.5.4) • fortinet fortinac (>= 8.6.0 <= 8.6.5) • fortinet fortinac (>= 8.7.0 <= 8.7.6) • fortinet fortinac (>= 8.8.0 <= 8.8.11) • fortinet fortinac (>= 9.1.0 <= 9.1.9) • fortinet fortinac (>= 9.2.0 <= 9.2.7) • fortinet fortinac 7.2.0 • fortinet fortinac 7.2.1 • fortinet fortinac 8.3.7 • fortinet fortinac 9.4.0 • fortinet fortinac 9.4.1 • fortinet fortinac 9.4.2

Related

Weakness · CWE (1)

  • CWE-502 Deserialization of Untrusted Data weakness

References