PT-2023-14786 · Fortinet · Fortinac-F+1

Published 2023-05-03 · Updated 2023-05-11 · CVE-2022-45860

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions FortiNAC-F version 7.2.0 FortiNAC versions 9.4.2 and below FortiNAC version 9.2 and earlier FortiNAC version 9.1 and earlier FortiNAC version 8.8 and earlier FortiNAC version 8.7 and earlier

Description A weak authentication issue in the device registration page may allow an unauthenticated attacker to perform password spraying attacks with an increased chance of success. This could potentially affect a large number of devices, but the exact number is not specified.

Recommendations For FortiNAC-F version 7.2.0, update to a version that includes a fix for this issue. For FortiNAC versions 9.4.2 and below, update to a version above 9.4.2 or apply the recommended fix. For FortiNAC version 9.2 and earlier, update to a version later than 9.2. For FortiNAC version 9.1 and earlier, update to a version later than 9.1. For FortiNAC version 8.8 and earlier, update to a version later than 8.8. For FortiNAC version 8.7 and earlier, update to a version later than 8.7. As a temporary workaround, consider restricting access to the device registration page to minimize the risk of exploitation.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

CWE-1390

Related Identifiers

CVE-2022-45860

Affected Products

Fortinac

Fortinac-F

References · 5

• https://osv.dev/vulnerability/CVE-2022-45860 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-45860 · Security Note
• https://fortiguard.com/psirt/FG-IR-22-464 · Vendor Advisory
• https://t.me/cibsecurity/63273 · Telegram Post
• https://t.me/cvenotify/49777 · Telegram Post