CVE-2023-33299

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A deserialization of untrusted data in Fortinet FortiNAC below 7.2.1, below 9.4.3, below 9.2.8 and all earlier versions of 8.x allows attacker to execute unauthorized code or commands via specifically crafted request on inter-server communication port. Note FortiNAC versions 8.x will not be fixed.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-502

Affected software

Vendor	Product	Versions
Fortinet	FortiNAC	>= 9.4.0, <= 9.4.2; >= 9.2.0, <= 9.2.7; >= 9.1.0, <= 9.1.9; >= 8.8.0, <= 8.8.11; >= 8.7.0, <= 8.7.6; >= 8.6.0, <= 8.6.5; >= 8.5.0, <= 8.5.4; 8.3.7; >= 7.2.0, <= 7.2.1

References

https://fortiguard.com/psirt/FG-IR-23-074Vendor Advisory
https://fortiguard.com/psirt/FG-IR-23-074Vendor Advisory

Timeline

Published: Jun 23, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-33304.3Improper Limitation of a Pathname to a Restricted Directory vulnerability in NEC Corporation Aterm WG2600HP2, WG2600HP, WG2200HP, WG1800HP2,CVE-2023-333005.3A improper neutralization of special elements used in a command ('command injection') in Fortinet FortiNAC 7.2.1 and earlier, 9.4.3 and earl CVE-2023-333014.3An improper access control vulnerability in Fortinet FortiOS 7.2.0 - 7.2.4 and 7.4.0 allows an attacker to access a restricted resource from CVE-2023-333028.8A buffer copy without checking size of input ('classic buffer overflow') in Fortinet FortiMail webmail and administrative interface version CVE-2023-333038.1A insufficient session expiration in Fortinet FortiEDR version 5.0.0 through 5.0.1 allows attacker to execute unauthorized code or commands CVE-2023-333045.5A use of hard-coded credentials vulnerability in Fortinet FortiClient Windows 7.0.0 - 7.0.9 and 7.2.0 - 7.2.1 allows an attacker to bypass s CVE-2023-333056.5A loop with unreachable exit condition ('infinite loop') in Fortinet FortiOS version 7.2.0 through 7.2.4, FortiOS version 7.0.0 through 7.0.CVE-2023-333066.5A null pointer dereference in Fortinet FortiOS before 7.2.5, before 7.0.11 and before 6.4.13, FortiProxy before 7.2.4 and before 7.0.10 all CVE-2023-333076.5A null pointer dereference in Fortinet FortiOS before 7.2.5 and before 7.0.11, FortiProxy before 7.2.3 and before 7.0.9 allows attacker to d CVE-2023-333089.8A stack-based overflow vulnerability [CWE-124] in Fortinet FortiOS version 7.0.0 through 7.0.10 and 7.2.0 through 7.2.3 and FortiProxy versi CVE-2023-333096.1Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Awesome Motive Duplicator Pro plugin <= 4.5.11 versions.CVE-2023-33315.4Improper Limitation of a Pathname to a Restricted Directory vulnerability in NEC Corporation Aterm Aterm WG2600HP2, WG2600HP, WG2200HP, WG18