CVE-2023-33299 Deserialization in FortiNAC

What is CVE-2023-33299?

CVE-2023-33299 is a critical unsafe deserialization vulnerability in Fortinet FortiNAC, published on 23 Jun 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A deserialization of untrusted data in Fortinet FortiNAC below 7.2.1, below 9.4.3, below 9.2.8 and all earlier versions of 8.x allows attacker to execute unauthorized code or commands via specifically crafted request on inter-server communication port. Note FortiNAC versions 8.x will not be fixed.

Weakness: CWE-502

Which versions are affected by CVE-2023-33299?

It affects 1 product.

Products include Fortinet Fortinac.

How do I fix CVE-2023-33299?

No fix has been published for CVE-2023-33299 yet. Limit exposure of the affected software until one is available.

Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.

Is CVE-2023-33299 being exploited?

There is no known exploitation of CVE-2023-33299 in the wild and no public exploit code.

Other vulnerabilities in Fortinet FortiNAC

• CVE-2022-39952 Path traversal in FortiNAC Critical 9.8
• CVE-2022-26117 Hardcoded credentials in Fortinet FortiNAC High 8.8
• CVE-2022-38375 Missing authorization in FortiNAC High 8.6
• CVE-2022-39953 Privilege escalation in FortiNAC High 7.8
• CVE-2021-43065 Privilege escalation in Fortinet FortiNAC High 7.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-2j65-72jp-x2mj.