PT-2023-3426 · Fortinet · Fortinac

Published 2023-06-12 · Updated 2023-06-17 · CVE-2023-22633

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions FortiNAC versions 7.2.0, 9.4.1 and below, 9.2.6 and below, 9.1.8 and below, 8.8.0, 8.7.0

Description The issue is related to improper permissions, privileges, and access controls in FortiNAC, which can be exploited by an unauthenticated attacker to perform a denial-of-service (DoS) attack on the device. This can be achieved via client-secure renegotiation, allowing a remote attacker to cause a service disruption.

Recommendations For FortiNAC version 7.2.0, update to a version that addresses the improper permissions issue. For FortiNAC versions 9.4.1 and below, 9.2.6 and below, 9.1.8 and below, update to a version above these ranges to mitigate the risk. For FortiNAC versions 8.8.0 and 8.7.0, consider restricting access to the client-secure renegotiation feature until a patch is available. As a temporary workaround, consider disabling the client-secure renegotiation feature to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

BDU:2023-03605

CVE-2023-22633

Affected Products

Fortinac

References · 5

• https://osv.dev/vulnerability/CVE-2023-22633 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-22633 · Security Note
• https://bdu.fstec.ru/vul/2023-03605 · Security Note
• https://fortiguard.com/psirt/FG-IR-22-521 · Vendor Advisory
• https://vuldb.com/?id.231307 · Note