CVE-2023-33299

CRITICAL

Fortinet FortiNAC <7.2.1, <9.4.3, <9.2.8, <=8.x - Use After Free

Title source: llm

Description

A deserialization of untrusted data in Fortinet FortiNAC below 7.2.1, below 9.4.3, below 9.2.8 and all earlier versions of 8.x allows attacker to execute unauthorized code or commands via specifically crafted request on inter-server communication port. Note FortiNAC versions 8.x will not be fixed.

References (1)

Core 1

Core References

Vendor Advisory

https://fortiguard.com/psirt/FG-IR-23-074

Scores

CVSS v3 9.8

EPSS 0.1091

EPSS Percentile 93.5%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation none

Automatable yes

Technical Impact total

Details

CWE

CWE-502

Status published

Products (7)

fortinet/fortinac 7.2.0

fortinet/fortinac 7.2.1

fortinet/fortinac 8.3.7

fortinet/fortinac 9.4.0

fortinet/fortinac 9.4.1

fortinet/fortinac 9.4.2

fortinet/fortinac 8.5.0 - 8.5.4

Published Jun 23, 2023

Tracked Since Feb 18, 2026