FortiNAC - java untrusted object deserialization RCE

2023-06-2300:00:00

FortiGuard Labs

www.fortiguard.com

fortinac

deserialization

vulnerability

rce

crafted requests

tcp/1050 service

unauthorized code

unauthorized commands

unauthenticated user

cwe-502

java

0.002 Low

EPSS

Percentile

57.2%

JSON

A deserialization of untrusted data vulnerability [CWE-502] in FortiNAC may allow an unauthenticated user to execute unauthorized code or commands via specifically crafted requests to the tcp/1050 service.

CPENameOperatorVersion
fortinaceq9.4.2
fortinaceq9.4.1
fortinaceq9.4.0
fortinaceq9.2.7
fortinaceq9.2.6
fortinaceq9.2.5
fortinaceq9.2.4
fortinaceq9.2.3
fortinaceq9.2.2
fortinaceq9.2.1

Name	Operator	Version
fortinac	eq	9.4.2
fortinac	eq	9.4.1
fortinac	eq	9.4.0
fortinac	eq	9.2.7
fortinac	eq	9.2.6
fortinac	eq	9.2.5
fortinac	eq	9.2.4
fortinac	eq	9.2.3
fortinac	eq	9.2.2
fortinac	eq	9.2.1

Rows per page:

1-10 of 541

0.002 Low

EPSS

Percentile

57.2%

JSON

Related for FG-IR-23-074