FortiNAC vulnerabilities

18 known vulnerabilities in FortiNAC from Fortinet. 18 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.0 Critical severity

  FortiNAC: Improper Neutralization of Input During Web Page Generation

  CVE-2024-31488May 14, 2024FortinetEPSS 1.01%

  An improper neutralization of inputs during web page generation vulnerability [CWE-79] in FortiNAC version 9.4.0 through 9.4.4, 9.2.0 through 9.2.8, 9.1.0 through 9.1.10, 8.8.0 through 8.8.11, 8.7.0 through 8.7.6, 7.2.0 through 7.2.3 may allow a remote authent

• 9.8 Critical severity

  FortiNAC: Deserialization of Untrusted Data

  CVE-2023-33299Jun 23, 2023FortinetEPSS 24.3%

  A deserialization of untrusted data in Fortinet FortiNAC below 7.2.1, below 9.4.3, below 9.2.8 and all earlier versions of 8.x allows attacker to execute unauthorized code or commands via specifically crafted request on inter-server communication port. Note Fo

• 7.5 High severity

  An improper permissions, privileges, and access controls vulnerability [CWE-264] in FortiNAC-F…

  CVE-2023-22633Jun 13, 2023Fortinet

  An improper permissions, privileges, and access controls vulnerability [CWE-264] in FortiNAC-F 7.2.0, FortiNAC 9.4.1 and below, 9.2.6 and below, 9.1.8 and below, 8.8.0 all versions 8.7.0 all versions may allow an unauthenticated attacker to perform a DoS attac

• 7.2 High severity

  FortiNAC: Improper Access Control

  CVE-2022-39946Jun 13, 2023Fortinet

  An access control vulnerability [CWE-284] in FortiNAC version 9.4.2 and below, version 9.2.7 and below, 9.1 all versions, 8.8 all versions, 8.7 all versions, 8.6 all versions, 8.5 all versions may allow a remote attacker authenticated on the administrative int

• 7.8 High severity

  FortiNAC: Use of Hard-coded Credentials

  CVE-2023-26203May 3, 2023Fortinet

  A use of hard-coded credentials vulnerability [CWE-798] in FortiNAC-F version 7.2.0, FortiNAC version 9.4.2 and below, 9.2 all versions, 9.1 all versions, 8.8 all versions, 8.7 all versions may allow an authenticated attacker to access to the database via shel

• 9.0 Critical severity

  FortiNAC: Improper Neutralization of Input During Web Page Generation

  CVE-2023-22637May 3, 2023Fortinet

  An improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability [CWE-79] in FortiNAC-F version 7.2.0, FortiNAC version 9.4.2 and below, 9.2 all versions, 9.1 all versions, 8.8 all versions, 8.7 all versions in License Mana

• 7.5 High severity

  FortiNAC: Improper Authentication

  CVE-2022-45860May 3, 2023Fortinet

  A weak authentication vulnerability [CWE-1390] in FortiNAC-F version 7.2.0, FortiNAC version 9.4.2 and below, 9.2 all versions, 9.1 all versions, 8.8 all versions, 8.7 all versions in device registration page may allow an unauthenticated attacker to perform pa

• 7.4 High severity

  FortiNAC: Use of a Broken or Risky Cryptographic Algorithm

  CVE-2022-45858May 3, 2023Fortinet

  A use of a weak cryptographic algorithm vulnerability [CWE-327] in FortiNAC 9.4.1 and below, 9.2.6 and below, 9.1.0 all versions, 8.8.0 all versions, 8.7.0 all versions may increase the chances of an attacker to have access to sensitive information or to perfo

• 7.5 High severity

  FortiNAC: Exposure of Sensitive Information to an Unauthorized Actor

  CVE-2022-43951Apr 11, 2023Fortinet

  An exposure of sensitive information to an unauthorized actor vulnerability [CWE-200] in FortiNAC 9.4.1 and below, 9.2.6 and below, 9.1.8 and below, 8.8.11 and below, 8.7.6 and below may allow an unauthenticated attacker to access sensitive information via cra

• 7.8 High severity

  FortiNAC: Improper Privilege Management

  CVE-2022-39953Mar 7, 2023Fortinet

  A improper privilege management in Fortinet FortiNAC version 9.4.0 through 9.4.1, FortiNAC version 9.2.0 through 9.2.6, FortiNAC version 9.1.0 through 9.1.8, FortiNAC all versions 8.8, FortiNAC all versions 8.7, FortiNAC all versions 8.6, FortiNAC all versions

• 7.8 High severity

  FortiNAC: Insufficiently Protected Credentials

  CVE-2022-40678Feb 16, 2023Fortinet

  An insufficiently protected credentials in Fortinet FortiNAC versions 9.4.0, 9.2.0 through 9.2.5, 9.1.0 through 9.1.7, 8.8.0 through 8.8.11, 8.7.0 through 8.7.6, 8.6.0 through 8.6.5, 8.5.0 through 8.5.4, 8.3.7 may allow a local attacker with database access to

• 8.8 High severity

  FortiNAC: Improper Neutralization of Argument Delimiters in a Command

  CVE-2022-40677Feb 16, 2023Fortinet

  A improper neutralization of argument delimiters in a command ('argument injection') in Fortinet FortiNAC versions 9.4.0, 9.2.0 through 9.2.5, 9.1.0 through 9.1.7, 8.8.0 through 8.8.11, 8.7.0 through 8.7.6, 8.6.0 through 8.6.5, 8.5.0 through 8.5.4, 8.3.7 allow

• 7.4 High severity

  Some cryptographic issues in Fortinet FortiNAC versions 9.4.0 through 9.4.1, 9.2.0 through…

  CVE-2022-40675Feb 16, 2023Fortinet

  Some cryptographic issues in Fortinet FortiNAC versions 9.4.0 through 9.4.1, 9.2.0 through 9.2.7, 9.1.0 through 9.1.8, 8.8.0 through 8.8.11, 8.7.0 through 8.7.6, 8.6.0 through 8.6.5, 8.5.0 through 8.5.4, 8.3.7 may allow an attacker to decrypt and forge protoco

• 9.1 Critical severity

  FortiNAC: Improper Restriction of XML External Entity Reference

  CVE-2022-39954Feb 16, 2023Fortinet

  An improper restriction of xml external entity reference in Fortinet FortiNAC version 9.4.0 through 9.4.1, FortiNAC version 9.2.0 through 9.2.7, FortiNAC version 9.1.0 through 9.1.8, FortiNAC version 8.8.0 through 8.8.11, FortiNAC version 8.7.0 through 8.7.6,

• 9.8 Critical severity

  FortiNAC: Exposure of Resource to Wrong Sphere

  CVE-2022-39952Feb 16, 2023FortinetEPSS 99.8%

  A external control of file name or path in Fortinet FortiNAC versions 9.4.0, 9.2.0 through 9.2.5, 9.1.0 through 9.1.7, 8.8.0 through 8.8.11, 8.7.0 through 8.7.6, 8.6.0 through 8.6.5, 8.5.0 through 8.5.4, 8.3.7 may allow an unauthenticated attacker to execute u

• 9.8 Critical severity

  FortiNAC: Improper Authorization

  CVE-2022-38375Feb 16, 2023FortinetEPSS 1.08%

  An improper authorization vulnerability [CWE-285] in Fortinet FortiNAC version 9.4.0 through 9.4.1 and before 9.2.6 allows an unauthenticated user to perform some administrative operations over the FortiNAC instance via crafted HTTP POST requests.

• 8.8 High severity

  Fortinet FortiNAC: Weak Password Requirements

  CVE-2022-26117Jul 18, 2022Fortinet

  An empty password in configuration file vulnerability [CWE-258] in FortiNAC version 8.3.7 and below, 8.5.2 and below, 8.5.4, 8.6.0, 8.6.5 and below, 8.7.6 and below, 8.8.11 and below, 9.1.5 and below, 9.2.3 and below may allow an authenticated attacker to acce

• 8.8 High severity

  Fortinet FortiNAC: Improper Neutralization of Special Elements used in an SQL Command

  CVE-2022-26116May 11, 2022Fortinet

  Multiple improper neutralization of special elements used in SQL commands ('SQL Injection') vulnerability [CWE-89] in FortiNAC version 8.3.7 and below, 8.5.2 and below, 8.5.4, 8.6.0, 8.6.5 and below, 8.7.6 and below, 8.8.11 and below, 9.1.5 and below, 9.2.2 an