PT-2023-2200 · Fortinet · Fortinac

Published 2023-02-16 · Updated 2023-02-27 · CVE-2022-40678

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Fortinet FortiNAC versions 8.3.7, 8.5.0 through 8.5.4, 8.6.0 through 8.6.5, 8.7.0 through 8.7.6, 8.8.0 through 8.8.11, 9.1.0 through 9.1.7, 9.2.0 through 9.2.5, 9.4.0

Description The issue is related to insufficient protection of registration data in Fortinet FortiNAC, which may allow an attacker to recover user passwords by accessing the database.

Recommendations For Fortinet FortiNAC versions 8.3.7, 8.5.0 through 8.5.4, 8.6.0 through 8.6.5, 8.7.0 through 8.7.6, 8.8.0 through 8.8.11, 9.1.0 through 9.1.7, 9.2.0 through 9.2.5, 9.4.0, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Insufficiently Protected Credentials

Weakness Enumeration

CWE-522

Related Identifiers

BDU:2023-01945

CVE-2022-40678

Affected Products

Fortinac

References · 4

• https://osv.dev/vulnerability/CVE-2022-40678 · Vendor Advisory
• https://fortiguard.com/psirt/FG-IR-22-265 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-01945 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-40678 · Security Note