CVE-2023-33299

critical · 9.8

A deserialization of untrusted data in Fortinet FortiNAC below 7.2.1, below 9.4.3, below 9.2.8 and all earlier versions of 8.x allows attacker to execute unauthorized code or commands via specifically crafted request on inter-server communication port. Note FortiNAC versions 8.x will not be fixed.

9.8

CVSS

24.3%

EPSS (exploit prob.)

98th

EPSS percentile

2023-06-23

Published

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-502

Affected products

Vendor	Product	Affected versions
fortinet	fortinac	>= 8.5.0, <= 8.5.4
fortinet	fortinac	>= 8.6.0, <= 8.6.5
fortinet	fortinac	>= 8.7.0, <= 8.7.6
fortinet	fortinac	>= 8.8.0, <= 8.8.11
fortinet	fortinac	>= 9.1.0, <= 9.1.9
fortinet	fortinac	>= 9.2.0, <= 9.2.7
fortinet	fortinac	7.2.0
fortinet	fortinac	7.2.1
fortinet	fortinac	8.3.7
fortinet	fortinac	9.4.0
fortinet	fortinac	9.4.1
fortinet	fortinac	9.4.2

Check a specific version with /api/v1/cve/match.

References

https://fortiguard.com/psirt/FG-IR-23-074
https://fortiguard.com/psirt/FG-IR-23-074

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2023-33299