Lucene search

[email protected]CVE-2023-26203

HistoryMay 03, 2023 - 10:15 p.m.

CVE-2023-26203

2023-05-0322:15:18

CWE-798

[email protected]

web.nvd.nist.gov

cve-2023-26203

hard-coded credentials

vulnerability

fortinac-f

database access

nvd

cwe-798

7.8 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

7.4 High

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

8.8%

JSON

A use of hard-coded credentials vulnerability [CWE-798] in FortiNAC-F version 7.2.0, FortiNAC version 9.4.2 and below, 9.2 all versions, 9.1 all versions, 8.8 all versions, 8.7 all versions may allow an authenticated attacker to access to the database via shell commands.

Affected configurations

NVD

Node

fortinetfortinacRange8.7.0–9.2.7

fortinetfortinacRange9.4.0–9.4.3

fortinetfortinac-fMatch7.2.0

CPENameOperatorVersion
fortinet:fortinacfortinet fortinacle9.2.7
fortinet:fortinacfortinet fortinaclt9.4.3
fortinet:fortinac-ffortinet fortinac-feq7.2.0

CPE	Name	Operator	Version
fortinet:fortinac	fortinet fortinac	le	9.2.7
fortinet:fortinac	fortinet fortinac	lt	9.4.3
fortinet:fortinac-f	fortinet fortinac-f	eq	7.2.0

CNA Affected

[
  {
    "vendor": "Fortinet",
    "product": "FortiNAC",
    "defaultStatus": "unaffected",
    "versions": [
      {
        "versionType": "semver",
        "version": "9.4.0",
        "lessThanOrEqual": "9.4.1",
        "status": "affected"
      },
      {
        "versionType": "semver",
        "version": "9.2.0",
        "lessThanOrEqual": "9.2.7",
        "status": "affected"
      },
      {
        "versionType": "semver",
        "version": "9.1.0",
        "lessThanOrEqual": "9.1.9",
        "status": "affected"
      },
      {
        "versionType": "semver",
        "version": "8.8.0",
        "lessThanOrEqual": "8.8.11",
        "status": "affected"
      },
      {
        "versionType": "semver",
        "version": "8.7.0",
        "lessThanOrEqual": "8.7.6",
        "status": "affected"
      },
      {
        "version": "7.2.0",
        "status": "affected"
      }
    ]
  }
]

References

fortiguard.com/psirt/FG-IR-22-520

7.8 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

7.4 High

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

8.8%

JSON

Related for CVE-2023-26203

fortinet1 nvd1 cvelist1 prion1