Fortinet Fortinac

Command Injection in FortiNAC <7.2.1 / <9.4.3 via inter-server port
CVE-2023-33300 - March 14, 2025

A improper neutralization of special elements used in a command ('command injection') in Fortinet FortiNAC 7.2.1 and earlier, 9.4.3 and earlier allows attacker a limited, unauthorized file access via specifically crafted request in inter-server communication port.

Command Injection

FortiNAC XSS Vulnerability 9.4.09.4.4 (CWE-79)
CVE-2024-31488 6.1 - Medium - May 14, 2024

An improper neutralization of inputs during web page generation vulnerability [CWE-79] in FortiNAC version 9.4.0 through 9.4.4, 9.2.0 through 9.2.8, 9.1.0 through 9.1.10, 8.8.0 through 8.8.11, 8.7.0 through 8.7.6, 7.2.0 through 7.2.3 may allow a remote authenticated attacker to perform stored and reflected cross site scripting (XSS) attack via crafted HTTP requests.

XSS

FortiNAC 7.2.0-9.4.2 XSS via Policy Audit Log Name Fields
CVE-2023-26206 6.1 - Medium - February 15, 2024

An improper neutralization of input during web page generation ('cross-site scripting') in Fortinet FortiNAC 9.4.0 - 9.4.2, 9.2.0 - 9.2.8, 9.1.0 - 9.1.10 and 7.2.0 allows an attacker to execute unauthorized code or commands via the name fields observed in the policy audit logs.

XSS

FortiNAC Deserialization via Inter-Server Port, <7.2.1/9.4.3/9.2.8
CVE-2023-33299 9.8 - Critical - June 23, 2023

A deserialization of untrusted data in Fortinet FortiNAC below 7.2.1, below 9.4.3, below 9.2.8 and all earlier versions of 8.x allows attacker to execute unauthorized code or commands via specifically crafted request on inter-server communication port. Note FortiNAC versions 8.x will not be fixed.

Marshaling, Unmarshaling

FortiNAC-F 7.2.0/9.x DoS via Unauth Client Secure Renegotiation (CWE-264)
CVE-2023-22633 7.5 - High - June 13, 2023

An improper permissions, privileges, and access controls vulnerability [CWE-264] in FortiNAC-F 7.2.0, FortiNAC 9.4.1 and below, 9.2.6 and below, 9.1.8 and below, 8.8.0 all versions 8.7.0 all versions may allow an unauthenticated attacker to perform a DoS attack on the device via client-secure renegotiation.

FortiNAC 9.4.2 Auth JSP Call Access Control Bypass
CVE-2022-39946 7.2 - High - June 13, 2023

An access control vulnerability [CWE-284] in FortiNAC version 9.4.2 and below, version 9.2.7 and below, 9.1 all versions, 8.8 all versions, 8.7 all versions, 8.6 all versions, 8.5 all versions may allow a remote attacker authenticated on the administrative interface to perform unauthorized jsp calls via crafted HTTP requests.

FortiNAC Open Redirect (CWE-601) via crafted URL in v7.2.0 & below
CVE-2022-43950 4.7 - Medium - May 03, 2023

A URL redirection to untrusted site ('Open Redirect') vulnerability [CWE-601] in FortiNAC-F version 7.2.0, FortiNAC version 9.4.1 and below, 9.2 all versions, 9.1 all versions, 8.8 all versions, 8.7 all versions may allow an unauthenticated attacker to redirect users to any arbitrary website via a crafted URL.

Open Redirect

Weak Cryptography in FortiNAC (9.4.1, 9.2.6, 9.1.0) Enables MITM
CVE-2022-45858 7.4 - High - May 03, 2023

A use of a weak cryptographic algorithm vulnerability [CWE-327] in FortiNAC 9.4.1 and below, 9.2.6 and below, 9.1.0 all versions, 8.8.0 all versions, 8.7.0 all versions may increase the chances of an attacker to have access to sensitive information or to perform man-in-the-middle attacks.

Use of a Broken or Risky Cryptographic Algorithm

FortiNAC-F 7.2.0 & prior: Local Auth Can Retrieve User Passwords (CWE-522)
CVE-2022-45859 4.4 - Medium - May 03, 2023

An insufficiently protected credentials vulnerability [CWE-522] in FortiNAC-F 7.2.0, FortiNAC 9.4.1 and below, 9.2.6 and below, 9.1.8 and below, 8.8.0 all versions, 8.7.0 all versions may allow a local attacker with system access to retrieve users' passwords.

Insufficiently Protected Credentials

Weak Auth FortiNAC-F v7.2.0 & <=9.4.2: Unauth Pass Spraying via Reg Page
CVE-2022-45860 7.5 - High - May 03, 2023

A weak authentication vulnerability [CWE-1390] in FortiNAC-F version 7.2.0, FortiNAC version 9.4.2 and below, 9.2 all versions, 9.1 all versions, 8.8 all versions, 8.7 all versions in device registration page may allow an unauthenticated attacker to perform password spraying attacks with an increased chance of success.

authentification

FortiNAC-7.2.0 hard-coded credentials allow DB shell access
CVE-2023-26203 7.8 - High - May 03, 2023

A use of hard-coded credentials vulnerability [CWE-798] in FortiNAC-F version 7.2.0, FortiNAC version 9.4.2 and below, 9.2 all versions, 9.1 all versions, 8.8 all versions, 8.7 all versions may allow an authenticated attacker to access to the database via shell commands.

Use of Hard-coded Credentials

XSS in FortiNAC-F 7.2.0 License Mgmt allows RCE for auth users
CVE-2023-22637 9 - Critical - May 03, 2023

An improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability [CWE-79] in FortiNAC-F version 7.2.0, FortiNAC version 9.4.2 and below, 9.2 all versions, 9.1 all versions, 8.8 all versions, 8.7 all versions in License Management would permit an authenticated attacker to trigger remote code execution via crafted licenses.

XSS

FortiNAC HTTP API Info Disclosure <=9.4.1 (CWE-200)
CVE-2022-43951 7.5 - High - April 11, 2023

An exposure of sensitive information to an unauthorized actor vulnerability [CWE-200] in FortiNAC 9.4.1 and below, 9.2.6 and below, 9.1.8 and below, 8.8.11 and below, 8.7.6 and below may allow an unauthenticated attacker to access sensitive information via crafted HTTP requests.

XSS in FortiNAC 9.4.0/9.2.0-9.2.5 web UI allows remote code exec
CVE-2022-40676 5.4 - Medium - March 07, 2023

A improper neutralization of input during web page generation ('cross-site scripting') in Fortinet FortiNAC versions 9.4.0, 9.2.0 through 9.2.5, 9.1.0 through 9.1.8, 8.8.0 through 8.8.11, 8.7.0 through 8.7.6, 8.6.0 through 8.6.5, 8.5.0 through 8.5.4, 8.3.7 allows attacker to execute unauthorized code or commands via specially crafted http requests.

XSS

FortiNAC 8.x-9.4.1 Improper Priv Escalation via Crafted Commands
CVE-2022-39953 7.8 - High - March 07, 2023

A improper privilege management in Fortinet FortiNAC version 9.4.0 through 9.4.1, FortiNAC version 9.2.0 through 9.2.6, FortiNAC version 9.1.0 through 9.1.8, FortiNAC all versions 8.8, FortiNAC all versions 8.7, FortiNAC all versions 8.6, FortiNAC all versions 8.5, FortiNAC version 8.3.7 allows attacker to escalation of privilege via specially crafted commands.

Improper Privilege Management

FortiNAC 8.3-9.4 XXE Allows File Read/DoS
CVE-2022-39954 9.1 - Critical - February 16, 2023

An improper restriction of xml external entity reference in Fortinet FortiNAC version 9.4.0 through 9.4.1, FortiNAC version 9.2.0 through 9.2.7, FortiNAC version 9.1.0 through 9.1.8, FortiNAC version 8.8.0 through 8.8.11, FortiNAC version 8.7.0 through 8.7.6, FortiNAC version 8.6.0 through 8.6.5, FortiNAC version 8.5.0 through 8.5.4, FortiNAC version 8.3.7 allows attacker to read arbitrary files or trigger a denial of service via specifically crafted XML documents.

XXE

FortiNAC Argument Injection CVE-2022-40677 8.3.79.4.0
CVE-2022-40677 8.8 - High - February 16, 2023

A improper neutralization of argument delimiters in a command ('argument injection') in Fortinet FortiNAC versions 9.4.0, 9.2.0 through 9.2.5, 9.1.0 through 9.1.7, 8.8.0 through 8.8.11, 8.7.0 through 8.7.6, 8.6.0 through 8.6.5, 8.5.0 through 8.5.4, 8.3.7 allows attacker to execute unauthorized code or commands via specially crafted input parameters.

Argument Injection

FortiNAC cred exposed before 9.4.0 (incl 9.2.0-9.2.5, 9.1.0-9.1.7, 8.8.0-8.8.11)
CVE-2022-40678 7.8 - High - February 16, 2023

An insufficiently protected credentials in Fortinet FortiNAC versions 9.4.0, 9.2.0 through 9.2.5, 9.1.0 through 9.1.7, 8.8.0 through 8.8.11, 8.7.0 through 8.7.6, 8.6.0 through 8.6.5, 8.5.0 through 8.5.4, 8.3.7 may allow a local attacker with database access to recover user passwords.

Insufficiently Protected Credentials

XSS in FortiNAC Web Page Generation (9.4.1, 9.2.6, ...)
CVE-2023-22638 5.4 - Medium - February 16, 2023

Several improper neutralization of inputs during web page generation vulnerability [CWE-79] in FortiNAC 9.4.1 and below, 9.2.6 and below, 9.1.8 and below, 8.8.11 and below, 8.7.6 and below, 8.6.5 and below, 8.5.4 and below, 8.3.7 and below may allow an authenticated attacker to perform several XSS attacks via crafted HTTP GET requests.

XSS

FortiNAC 9.4.09.4.1 Improper Auth Allow Unauth Admin Ops via HTTP POST
CVE-2022-38375 9.8 - Critical - February 16, 2023

An improper authorization vulnerability [CWE-285] in Fortinet FortiNAC version 9.4.0 through 9.4.1 and before 9.2.6 allows an unauthenticated user to perform some administrative operations over the FortiNAC instance via crafted HTTP POST requests.

FortiNAC External File Path Control (CVE-2022-39952) Unauth RCE
CVE-2022-39952 9.8 - Critical - February 16, 2023

A external control of file name or path in Fortinet FortiNAC versions 9.4.0, 9.2.0 through 9.2.5, 9.1.0 through 9.1.7, 8.8.0 through 8.8.11, 8.7.0 through 8.7.6, 8.6.0 through 8.6.5, 8.5.0 through 8.5.4, 8.3.7 may allow an unauthenticated attacker to execute unauthorized code or commands via specifically crafted HTTP request.

Exposure of Resource to Wrong Sphere

Fortinet FortiNAC Crypto Decrypt/Forge (9.4-9.2-9.1 series)
CVE-2022-40675 7.4 - High - February 16, 2023

Some cryptographic issues in Fortinet FortiNAC versions 9.4.0 through 9.4.1, 9.2.0 through 9.2.7, 9.1.0 through 9.1.8, 8.8.0 through 8.8.11, 8.7.0 through 8.7.6, 8.6.0 through 8.6.5, 8.5.0 through 8.5.4, 8.3.7 may allow an attacker to decrypt and forge protocol communication messages.

FortiNAC XSS Vulnerability (CWE-79) CVE-2022-38376 before 9.4.1
CVE-2022-38376 6.1 - Medium - February 16, 2023

Multiple improper neutralization of input during web page generation ('Cross-site Scripting') vulnerabilities [CWE-79] in Fortinet FortiNAC portal UI before 9.4.1 allows an attacker to perform an XSS attack via crafted HTTP requests.

XSS

An empty password in configuration file vulnerability [CWE-258] in FortiNAC version 8.3.7 and below, 8.5.2 and below, 8.5.4, 8.6.0, 8.6.5 and below, 8.7.6 and below, 8.8.11 and below, 9.1.5 and below, 9.2.3 and below may
CVE-2022-26117 8.8 - High - July 18, 2022

An empty password in configuration file vulnerability [CWE-258] in FortiNAC version 8.3.7 and below, 8.5.2 and below, 8.5.4, 8.6.0, 8.6.5 and below, 8.7.6 and below, 8.8.11 and below, 9.1.5 and below, 9.2.3 and below may allow an authenticated attacker to access the MySQL databases via the CLI.

Weak Password Requirements

Multiple improper neutralization of special elements used in SQL commands ('SQL Injection') vulnerability [CWE-89] in FortiNAC version 8.3.7 and below, 8.5.2 and below, 8.5.4, 8.6.0, 8.6.5 and below, 8.7.6 and below, 8.8.11 and below, 9.1.5 and below, 9.2.2 and below may
CVE-2022-26116 8.8 - High - May 11, 2022

Multiple improper neutralization of special elements used in SQL commands ('SQL Injection') vulnerability [CWE-89] in FortiNAC version 8.3.7 and below, 8.5.2 and below, 8.5.4, 8.6.0, 8.6.5 and below, 8.7.6 and below, 8.8.11 and below, 9.1.5 and below, 9.2.2 and below may allow an authenticated attacker to execute unauthorized code or commands via specifically crafted strings parameters.

SQL Injection

A incorrect permission assignment for critical resource in Fortinet FortiNAC version 9.2.0, version 9.1.3 and below, version 8.8.9 and below
CVE-2021-43065 7.8 - High - December 09, 2021

A incorrect permission assignment for critical resource in Fortinet FortiNAC version 9.2.0, version 9.1.3 and below, version 8.8.9 and below allows attacker to gain higher privileges via the access to sensitive system data.

Incorrect Permission Assignment for Critical Resource

A privilege escalation vulnerability in FortiNAC versions 8.8.8 and below and 9.1.2 and below may
CVE-2021-41021 6.7 - Medium - December 08, 2021

A privilege escalation vulnerability in FortiNAC versions 8.8.8 and below and 9.1.2 and below may allow an admin user to escalate the privileges to root via the sudo command.

A privilege escalation vulnerability in FortiNAC version below 8.8.2 may
CVE-2021-24011 7.2 - High - May 10, 2021

A privilege escalation vulnerability in FortiNAC version below 8.8.2 may allow an admin user to escalate the privileges to root by abusing the sudo privileges.

An improper neutralization of input vulnerability in FortiNAC before 8.7.2 may
CVE-2020-12816 - September 24, 2020

An improper neutralization of input vulnerability in FortiNAC before 8.7.2 may allow a remote authenticated attacker to perform a stored cross site scripting attack (XSS) via the UserID of Admin Users.

An Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") in Fortinet FortiNAC 8.3.0 to 8.3.6 and 8.5.0 admin webUI may
CVE-2019-5594 6.1 - Medium - August 23, 2019

An Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") in Fortinet FortiNAC 8.3.0 to 8.3.6 and 8.5.0 admin webUI may allow an unauthenticated attacker to perform a reflected XSS attack via the search field in the webUI.

XSS