Severity
High
Analysis Summary
CVE-2023-33300 CVSS:5.3
Fortinet FortiNAC could allow a remote attacker to gain unauthorized access to the system, caused by a command injection vulnerability. By sending a specially crafted request to the tcp/5555 service, an attacker could exploit this vulnerability to copy local files of the device to other local directories of the device.
CVE-2023-33299 CVSS:9.8
Fortinet FortiNAC could allow a remote attacker to execute arbitrary code on the system, caused by a deserialization of untrusted data vulnerability. By sending a specially crafted request to the tcp/1050 service, an attacker could exploit this vulnerability to execute arbitrary code or commands on the system.
Impact
- Gain Access
- Code Execution
Indicators Of Compromise
CVE
- CVE-2023-33300
- CVE-2023-33299
Affected Vendors
Fortinet
Affected Products
- Fortinet FortiNAC 7.2.1
- Fortinet FortiNAC 7.2.0
- Fortinet FortiNAC 8.5.4
- Fortinet FortiNAC 8.6.5
- Fortinet FortiNAC 8.7.6
- Fortinet FortiNAC 8.8.11
- Fortinet FortiNAC 9.1.0
- Fortinet FortiNAC 9.2.0
- Fortinet FortiNAC 9.4.0
- Fortinet FortiNAC 9.2.5
- Fortinet FortiNAC 9.1.7
- Fortinet FortiNAC 8.3
- Fortinet FortiNAC 8.8
- Fortinet FortiNAC 8.7
- Fortinet FortiNAC 8.6
- Fortinet FortiNAC 8.5
Remediation
Refer to FortiGuard Advisory for patch, upgrade or suggested workaround information.