FortiNAC - database harcoded credentials

Summary

A use of hard-coded credentials vulnerability [CWE-798] in FortiNAC may allow an authenticated attacker to access to the database via shell commands.

Affected Products

At least
FortiNAC version 9.4.0 through 9.4.2
FortiNAC 9.2 all versions
FortiNAC 9.1 all versions
FortiNAC 8.8 all versions
FortiNAC 8.7 all versions
FortiNAC 8.6 all versions are not affected
FortiNAC 8.5 all versions are not affected
FortiNAC version 7.2.0

Solutions

Please upgrade to FortiNAC version 9.4.3 or above
Please upgrade to FortiNAC-F version 7.2.1 or above

Acknowledgement

Fortinet is pleased to thank KPN for bringing this issue to our attention under responsible disclosure.

Timeline

2023-05-03: Initial publication