Fortinet FortiNAC
23 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2023-33300 | 9.4.0 – 9.4.3 ; 7.2.0 – 7.2.1 | A improper neutralization of special elements used in a command ('command injection') in Fortinet FortiNAC 7.2.1 and earlier, 9.4.3 and earl | MEDIUM 5.3 | 14 % | ||
| CVE-2024-31488 | 9.4.0 – 9.4.3 ; 9.2.0 – 9.2.8 ; 9.1.0 – 9.1.10 ; … | An improper neutralization of inputs during web page generation vulnerability [CWE-79] in FortiNAC version 9.4.0 through 9.4.4, 9.2.0 throug | CRITICAL 9.0 | 1.0 % | ||
| CVE-2023-26206 | 9.4.0 – 9.4.2 ; 9.2.0 – 9.2.8 ; 9.1.0 – 9.1.10 ; … | An improper neutralization of input during web page generation ('cross-site scripting') in Fortinet FortiNAC 9.4.0 - 9.4.2, 9.2.0 - 9.2.8, 9 | MEDIUM 6.8 | 0.5 % | ||
| CVE-2023-33299 | 9.4.0 – 9.4.2 ; 9.2.0 – 9.2.7 ; 9.1.0 – 9.1.9 ; … | A deserialization of untrusted data in Fortinet FortiNAC below 7.2.1, below 9.4.3, below 9.2.8 and all earlier versions of 8.x allows attack | CRITICAL 9.8 | 24 % | ||
| CVE-2023-22633 | 9.4.0 – 9.4.1 ; 9.2.0 – 9.2.6 ; 9.1.0 – 9.1.8 ; … | An improper permissions, privileges, and access controls vulnerability [CWE-264] in FortiNAC-F 7.2.0, FortiNAC 9.4.1 and below, 9.2.6 and be | HIGH 7.5 | 0.7 % | ||
| CVE-2022-39946 | 9.4.0 – 9.4.1 ; 9.2.0 – 9.2.6 ; 9.1.0 – 9.1.10 ; … | An access control vulnerability [CWE-284] in FortiNAC version 9.4.2 and below, version 9.2.7 and below, 9.1 all versions, 8.8 all versions, | HIGH 7.2 | 0.7 % | ||
| CVE-2023-22637 | 9.4.0 – 9.4.2 ; 9.2.0 – 9.2.7 ; 9.1.0 – 9.1.9 ; … | An improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability [CWE-79] in FortiNAC-F version 7.2.0, | CRITICAL 9.0 | 0.6 % | ||
| CVE-2023-26203 | 9.4.0 – 9.4.1 ; 9.2.0 – 9.2.7 ; 9.1.0 – 9.1.9 ; … | A use of hard-coded credentials vulnerability [CWE-798] in FortiNAC-F version 7.2.0, FortiNAC version 9.4.2 and below, 9.2 all versions, 9.1 | HIGH 7.8 | 0.2 % | ||
| CVE-2022-45860 | 9.4.0 – 9.4.2 ; 9.2.0 – 9.2.6 ; 9.1.0 – 9.1.9 ; … | A weak authentication vulnerability [CWE-1390] in FortiNAC-F version 7.2.0, FortiNAC version 9.4.2 and below, 9.2 all versions, 9.1 all vers | HIGH 7.5 | 0.5 % | ||
| CVE-2022-45858 | 9.4.0 – 9.4.1 ; 9.2.0 – 9.2.6 ; 9.1.0 – 9.1.9 ; … | A use of a weak cryptographic algorithm vulnerability [CWE-327] in FortiNAC 9.4.1 and below, 9.2.6 and below, 9.1.0 all versions, 8.8.0 all | HIGH 7.4 | 0.2 % | ||
| CVE-2022-43950 | 9.4.0 – 9.4.1 ; 9.2.0 – 9.2.7 ; 9.1.0 – 9.1.9 ; … | A URL redirection to untrusted site ('Open Redirect') vulnerability [CWE-601] in FortiNAC-F version 7.2.0, FortiNAC version 9.4.1 and below, | MEDIUM 4.7 | 0.4 % | ||
| CVE-2022-45859 | 9.4.0 – 9.4.1 ; 9.2.0 – 9.2.6 ; 9.1.0 – 9.1.8 ; … | An insufficiently protected credentials vulnerability [CWE-522] in FortiNAC-F 7.2.0, FortiNAC 9.4.1 and below, 9.2.6 and below, 9.1.8 and be | MEDIUM 4.4 | 0.1 % | ||
| CVE-2022-43951 | 9.4.0 – 9.4.1 ; 9.2.0 – 9.2.7 ; 9.1.0 – 9.1.9 ; … | An exposure of sensitive information to an unauthorized actor vulnerability [CWE-200] in FortiNAC 9.4.1 and below, 9.2.6 and below, 9.1.8 an | HIGH 7.5 | 0.6 % | ||
| CVE-2022-40676 | 9.4.0 ; 9.2.0 – 9.2.5 ; 9.1.0 – 9.1.8 ; … | A improper neutralization of input during web page generation ('cross-site scripting') in Fortinet FortiNAC versions 9.4.0, 9.2.0 through 9. | HIGH 7.1 | 0.5 % | ||
| CVE-2022-39953 | 9.4.0 – 9.4.1 ; 9.2.0 – 9.2.6 ; 9.1.0 – 9.1.8 ; … | A improper privilege management in Fortinet FortiNAC version 9.4.0 through 9.4.1, FortiNAC version 9.2.0 through 9.2.6, FortiNAC version 9.1 | HIGH 7.8 | 0.2 % | ||
| CVE-2023-22638 | 9.4.0 – 9.4.1 ; 9.2.0 – 9.2.7 ; 9.1.0 – 9.1.8 ; … | Several improper neutralization of inputs during web page generation vulnerability [CWE-79] in FortiNAC 9.4.1 and below, 9.2.6 and below, 9 | MEDIUM 6.7 | 0.5 % | ||
| CVE-2022-40677 | 9.4.0 ; 9.2.0 – 9.2.5 ; 9.1.0 – 9.1.7 ; … | A improper neutralization of argument delimiters in a command ('argument injection') in Fortinet FortiNAC versions 9.4.0, 9.2.0 through 9.2. | HIGH 8.8 | 0.8 % | ||
| CVE-2022-39952 | 9.4.0 ; 9.2.0 – 9.2.5 ; 9.1.0 – 9.1.7 ; … | A external control of file name or path in Fortinet FortiNAC versions 9.4.0, 9.2.0 through 9.2.5, 9.1.0 through 9.1.7, 8.8.0 through 8.8.11, | CRITICAL 9.8 | 100 % | ||
| CVE-2022-40675 | 9.4.0 – 9.4.1 ; 9.2.0 – 9.2.7 ; 9.1.0 – 9.1.8 ; … | Some cryptographic issues in Fortinet FortiNAC versions 9.4.0 through 9.4.1, 9.2.0 through 9.2.7, 9.1.0 through 9.1.8, 8.8.0 through 8.8.11, | HIGH 7.4 | 0.4 % | ||
| CVE-2022-39954 | 9.4.0 – 9.4.1 ; 9.2.0 – 9.2.7 ; 9.1.0 – 9.1.8 ; … | An improper restriction of xml external entity reference in Fortinet FortiNAC version 9.4.0 through 9.4.1, FortiNAC version 9.2.0 through 9. | CRITICAL 9.1 | 0.5 % | ||
| CVE-2022-40678 | 9.4.0 ; 9.2.0 – 9.2.5 ; 9.1.0 – 9.1.7 ; … | An insufficiently protected credentials in Fortinet FortiNAC versions 9.4.0, 9.2.0 through 9.2.5, 9.1.0 through 9.1.7, 8.8.0 through 8.8.11, | HIGH 7.8 | 0.1 % | ||
| CVE-2022-38376 | 9.4.0 – 9.4.1 ; 9.2.0 – 9.2.7 ; 9.1.0 – 9.1.8 ; … | Multiple improper neutralization of input during web page generation ('Cross-site Scripting') vulnerabilities [CWE-79] in Fortinet FortiNAC | MEDIUM 6.1 | 0.6 % | ||
| CVE-2022-38375 | 9.4.0 – 9.4.1 ; 9.2.0 – 9.2.6 | An improper authorization vulnerability [CWE-285] in Fortinet FortiNAC version 9.4.0 through 9.4.1 and before 9.2.6 allows an unauthenticat | CRITICAL 9.8 | 1.1 % |