PT-2022-17684 · Fortinet · Fortinac

Published 2022-05-11 · Updated 2022-05-18 · CVE-2022-26116

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions FortiNAC versions 8.3.7 and below FortiNAC versions 8.5.2 and below FortiNAC versions 8.5.4 FortiNAC version 8.6.0 FortiNAC versions 8.6.5 and below FortiNAC versions 8.7.6 and below FortiNAC versions 8.8.11 and below FortiNAC versions 9.1.5 and below FortiNAC versions 9.2.2 and below

Description The issue is related to improper neutralization of special elements used in SQL commands, also known as SQL Injection. This may allow an authenticated attacker to execute unauthorized code or commands via specifically crafted string parameters.

Recommendations For FortiNAC versions 8.3.7 and below, update to a version above 8.3.7. For FortiNAC versions 8.5.2 and below, update to a version above 8.5.2. For FortiNAC version 8.5.4, update to a version above 8.5.4. For FortiNAC version 8.6.0, update to a version above 8.6.0. For FortiNAC versions 8.6.5 and below, update to a version above 8.6.5. For FortiNAC versions 8.7.6 and below, update to a version above 8.7.6. For FortiNAC versions 8.8.11 and below, update to a version above 8.8.11. For FortiNAC versions 9.1.5 and below, update to a version above 9.1.5. For FortiNAC versions 9.2.2 and below, update to a version above 9.2.2. As a temporary workaround, consider restricting access to SQL commands to minimize the risk of exploitation.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2022-26116

Affected Products

Fortinac

References · 6

• https://fortiguard.com/psirt/FG-IR-22-062 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-26116 · Security Note
• https://osv.dev/vulnerability/CVE-2022-26116 · Vendor Advisory
• https://t.me/cvenotify/30013 · Telegram Post
• https://t.me/cibsecurity/42330 · Telegram Post
• https://t.me/cvenotify/30010 · Telegram Post