CVE-2023-33299

Published: Jun 23, 2023Modified: Jun 17, 2026

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

A deserialization of untrusted data in Fortinet FortiNAC below 7.2.1, below 9.4.3, below 9.2.8 and all earlier versions of 8.x allows attacker to execute unauthorized code or commands via specifically crafted request on inter-server communication port. Note FortiNAC versions 8.x will not be fixed.

Affected (12)

Products: Fortinet: Fortinac

Fortinet

1 product

Fortinac

Configuration A

12 vulnerable

Vulnerable Software	Affected Versions
Fortinet Fortinac	From 8.5.0 to 8.5.4
Fortinet Fortinac	From 8.6.0 to 8.6.5
Fortinet Fortinac	From 8.7.0 to 8.7.6
Fortinet Fortinac	From 8.8.0 to 8.8.11
Fortinet Fortinac	From 9.1.0 to 9.1.9
Fortinet Fortinac	From 9.2.0 to 9.2.7
Fortinet Fortinac	Version 7.2.0
Fortinet Fortinac	Version 7.2.1
Fortinet Fortinac	Version 8.3.7
Fortinet Fortinac	Version 9.4.0
Fortinet Fortinac	Version 9.4.1
Fortinet Fortinac	Version 9.4.2

Related CWEs

CWE-502

Deserialization of Untrusted Data

The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.

References (2)

https://fortiguard.com/psirt/FG-IR-23-074

Source: psirt@fortinet.com

Vendor Advisory

https://fortiguard.com/psirt/FG-IR-23-074

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.