PT-2023-3426 · Fortinet · Fortinac

Publicado 2023-06-12 · Atualizado 2023-06-17 · CVE-2023-22633

Positive Technologies (AI Summary)

CVSS v2.0

7.8

Alta

Vetor base

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions FortiNAC versions 7.2.0, 9.4.1 and below, 9.2.6 and below, 9.1.8 and below, 8.8.0, 8.7.0

Description The issue is related to improper permissions, privileges, and access controls in FortiNAC, which can be exploited by an unauthenticated attacker to perform a denial-of-service (DoS) attack on the device. This can be achieved via client-secure renegotiation, allowing a remote attacker to cause a service disruption.

Recommendations For FortiNAC version 7.2.0, update to a version that addresses the improper permissions issue. For FortiNAC versions 9.4.1 and below, 9.2.6 and below, 9.1.8 and below, update to a version above these ranges to mitigate the risk. For FortiNAC versions 8.8.0 and 8.7.0, consider restricting access to the client-secure renegotiation feature until a patch is available. As a temporary workaround, consider disabling the client-secure renegotiation feature to minimize the risk of exploitation.

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

BDU:2023-03605

CVE-2023-22633

Produtos afetados

Fortinac

Referências · 5

• https://osv.dev/vulnerability/CVE-2023-22633 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-22633 · Nota de Segurança
• https://bdu.fstec.ru/vul/2023-03605 · Nota de Segurança
• https://fortiguard.com/psirt/FG-IR-22-521 · Aviso do Fabricante
• https://vuldb.com/?id.231307 · Nota