PT-2023-24279 · Fortinet · Fortinac

Published 2023-05-22 · Updated 2025-03-14 · CVE-2023-33300

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions: Fortinet FortiNAC versions 7.2.1 and earlier, 9.4.3 and earlier

Description: The issue is related to an improper neutralization of special elements used in a command, also known as 'command injection', which allows an attacker to gain limited, unauthorized file access. This can be achieved by sending a specifically crafted request in inter-server communication port.

Recommendations: For Fortinet FortiNAC versions 7.2.1 and earlier, consider restricting access to the inter-server communication port as a temporary workaround until a patch is available. For Fortinet FortiNAC version 9.4.3 and earlier, restrict access to the inter-server communication port to minimize the risk of exploitation.

Fix

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

BDU:2025-02838

CVE-2023-33300

Affected Products

Fortinac

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2023-33300 · Security Note
• https://osv.dev/vulnerability/CVE-2023-33300 · Vendor Advisory
• https://fortiguard.com/psirt/FG-IR-23-096 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-02838 · Security Note
• https://t.me/purple_medved/50 · Telegram Post
• https://t.me/cvedetector/20324 · Telegram Post
• https://t.me/true_secator/4536 · Telegram Post
• https://twitter.com/CVEnew/status/1900582040975835407 · Twitter Post
• https://vuldb.com/?id.232277 · Note