CVE-2023-33299

CVSS 3.1: 9.8 critical
EPSS: 24%p98
Published: Jun 23, 2023 · Jun 23, 2023
Modified: Jun 17, 2026

Analyze CVE-2023-33299 with Vani AIImpact, affected versions, exploitation status, mitigations and detection

Description · NVD

A deserialization of untrusted data in Fortinet FortiNAC below 7.2.1, below 9.4.3, below 9.2.8 and all earlier versions of 8.x allows attacker to execute unauthorized code or commands via specifically crafted request on inter-server communication port. Note FortiNAC versions 8.x will not be fixed.

Vendors: fortinet

Products: fortinac

Weakness: CWE-502

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (24.3%)

In the news

2 stories

New Fortinet's FortiNAC Vulnerability Exposes Networks to Code Execution Attacks

The Hacker NewsJun 27, 05:35 UTC · Jun 27, 2023VulnerabilityExploitedCVE-2023-33299 CVE-2023-33300 CVE-2023-27997+23

Fortinet fixes critical FortiNAC RCE, install updates asap

Security AffairsJun 23, 14:55 UTC · Jun 23, 2023VulnerabilityCVE-2023-332991 · 1 read