FortiNAC - Multiple Command Injections in webserver

Summary

An improper neutralization of special elements used in an OS command vulnerability [CWE-78] in the webserver of FortiNAC may allow a privileged attacker to execute arbitrary OS commands via specially crafted input parameters.

Affected Products

FortiNAC version 9.4.0
FortiNAC version 9.2.0 through 9.2.5
FortiNAC version 9.1.0 through 9.1.7
FortiNAC 8.8, 8.7, 8.6, 8.5, 8.3  all versions

Solutions

Please upgrade to FortiNAC version 9.4.1 or above
Please upgrade to FortiNAC version 9.2.6 or above
Please upgrade to FortiNAC version 9.1.8 or above
Please upgrade to FortiNAC version 7.2.0 or above

Acknowledgement

Internally discovered and reported by Gwendal Guégniaud of Fortinet Product Security team.