Deserialization of untrusted data

2023-06-2308:15:00

PRIOn knowledge base

www.prio-n.com

deserialization

untrusted data

fortinet fortinac

vulnerability

unauthorized code execution

crafted request

inter-server communication

9.5 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

57.2%

JSON

A deserialization of untrusted data in Fortinet FortiNAC below 7.2.1, below 9.4.3, below 9.2.8 and all earlier versions of 8.x allows attacker to execute unauthorized code or commands via specifically crafted request on inter-server communication port. Note FortiNAC versions 8.x will not be fixed.

CPENameOperatorVersion
fortinacge8.6.0
fortinacle8.6.5
fortinacge8.8.0
fortinacle8.8.11
fortinacge8.7.0
fortinacle8.7.6
fortinaceq8.3.7
fortinaceq9.4.0
fortinacge8.5.0
fortinacle8.5.4

Name	Operator	Version
fortinac	ge	8.6.0
fortinac	le	8.6.5
fortinac	ge	8.8.0
fortinac	le	8.8.11
fortinac	ge	8.7.0
fortinac	le	8.7.6
fortinac	eq	8.3.7
fortinac	eq	9.4.0
fortinac	ge	8.5.0
fortinac	le	8.5.4