FortiNAC - SSL Renegotation leading to DoS
Summary
An improper permissions, privileges, and access controls vulnerability [CWE-264] in FortiNAC may allow an unauthenticated attacker to perform a DoS attack on the device via client-secure renegotiation.
Affected Products
At least
FortiNAC-F version 7.2.0
FortiNAC version 9.4.0 through 9.4.1
FortiNAC version 9.2.0 through 9.2.6
FortiNAC version 9.1.0 through 9.1.8
FortiNAC 8.8.0 all versions
FortiNAC 8.7.0 all versions
Solutions
Please upgrade to FortiNAC-F version 7.2.1 or above
Please upgrade to FortiNAC version 9.4.2 or above
Please upgrade to FortiNAC version 9.2.7 or above
Please upgrade to FortiNAC version 9.1.9 or above
Acknowledgement
Fortinet is pleased to thank KPN for bringing this issue to our attention under responsible disclosure.Timeline
2023-05-10: Initial publication