{"id":"CVE-2023-33299","state":"PUBLISHED","title":"A deserialization of untrusted data in Fortinet FortiNAC below 7.2.1, below 9.4.3, below 9.2.8 and all earlier versions of 8.x allows attacker to execute unauthorized code or comma","description":"A deserialization of untrusted data in Fortinet FortiNAC below 7.2.1, below 9.4.3, below 9.2.8 and all earlier versions of 8.x allows attacker to execute unauthorized code or commands via specifically crafted request on inter-server communication port. Note FortiNAC versions 8.x will not be fixed.","publishedAt":"2023-06-23T07:46:37.499Z","updatedAt":"2024-10-23T14:25:53.423Z","severity":{"score":9.6,"label":"Critical","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:X/RC:C","source":"fortinet"},"assigner":"fortinet","products":["Fortinet FortiNAC"],"affected":[{"vendor":"Fortinet","product":"FortiNAC","defaultStatus":"unaffected","versions":[{"version":"9.4.0","status":"affected","lessThanOrEqual":"9.4.2","versionType":"semver"},{"version":"9.2.0","status":"affected","lessThanOrEqual":"9.2.7","versionType":"semver"},{"version":"9.1.0","status":"affected","lessThanOrEqual":"9.1.9","versionType":"semver"},{"version":"8.8.0","status":"affected","lessThanOrEqual":"8.8.11","versionType":"semver"},{"version":"8.7.0","status":"affected","lessThanOrEqual":"8.7.6","versionType":"semver"},{"version":"8.6.0","status":"affected","lessThanOrEqual":"8.6.5","versionType":"semver"},{"version":"8.5.0","status":"affected","lessThanOrEqual":"8.5.4","versionType":"semver"},{"version":"8.3.7","status":"affected"},{"version":"7.2.0","status":"affected","lessThanOrEqual":"7.2.1","versionType":"semver"}]}],"references":["https://fortiguard.com/psirt/FG-IR-23-074"],"weaknesses":["CWE-502"],"ingestedAt":"2026-10-29T20:06:00.499Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2023/33xxx/CVE-2023-33299.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2023-33299","state":"PUBLISHED","datePublished":"2023-06-23T07:46:37.499Z","dateUpdated":"2024-10-23T14:25:53.423Z","assignerShortName":"fortinet","assignerOrgId":"6abe59d8-c742-4dff-8ce8-9b0ca1073da8","dateReserved":"2023-05-22T07:58:22.196Z"},"containers":{"cna":{"descriptions":[{"lang":"en","value":"A deserialization of untrusted data in Fortinet FortiNAC below 7.2.1, below 9.4.3, below 9.2.8 and all earlier versions of 8.x allows attacker to execute unauthorized code or commands via specifically crafted request on inter-server communication port. Note FortiNAC versions 8.x will not be fixed."}],"affected":[{"vendor":"Fortinet","product":"FortiNAC","defaultStatus":"unaffected","versions":[{"version":"9.4.0","status":"affected","lessThanOrEqual":"9.4.2","versionType":"semver"},{"version":"9.2.0","status":"affected","lessThanOrEqual":"9.2.7","versionType":"semver"},{"version":"9.1.0","status":"affected","lessThanOrEqual":"9.1.9","versionType":"semver"},{"version":"8.8.0","status":"affected","lessThanOrEqual":"8.8.11","versionType":"semver"},{"version":"8.7.0","status":"affected","lessThanOrEqual":"8.7.6","versionType":"semver"},{"version":"8.6.0","status":"affected","lessThanOrEqual":"8.6.5","versionType":"semver"},{"version":"8.5.0","status":"affected","lessThanOrEqual":"8.5.4","versionType":"semver"},{"version":"8.3.7","status":"affected"},{"version":"7.2.0","status":"affected","lessThanOrEqual":"7.2.1","versionType":"semver"}]}],"references":[{"url":"https://fortiguard.com/psirt/FG-IR-23-074","name":"https://fortiguard.com/psirt/FG-IR-23-074"}],"metrics":[{"format":"CVSS","cvssV3_1":{"version":"3.1","attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.6,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:X/RC:C"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-502","lang":"en","description":"Execute unauthorized code or commands","type":"CWE"}]}],"providerMetadata":{"shortName":"fortinet","orgId":"6abe59d8-c742-4dff-8ce8-9b0ca1073da8","dateUpdated":"2023-06-23T07:46:37.499Z"},"solutions":[{"lang":"en","value":"Please upgrade to FortiNAC version 9.4.3 or above Please upgrade to FortiNAC version 9.2.8 or above Please upgrade to FortiNAC version 9.1.10 or above Please upgrade to FortiNAC version 7.2.2 or above "}]},"adp":[{"title":"CVE Program Container","references":[{"url":"https://fortiguard.com/psirt/FG-IR-23-074","name":"https://fortiguard.com/psirt/FG-IR-23-074","tags":["x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-02T15:39:36.130Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2024-10-23T14:19:07.431174Z","id":"CVE-2023-33299","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2024-10-23T14:25:53.423Z"}}]}}}