Lack of certificate validation

Summary

An improper certificate validation vulnerability [CWE-295] in FortiNAC-F may allow a remote and unauthenticated attacker to perform a Man-in-the-Middle attack on the HTTPS communication channel between the FortiOS device, an inventory, and FortiNAC-F.

Acknowledgement

Fortinet is pleased to thank Christian Hilgers from indevis for reporting this vulnerability under responsible disclosure

Timeline

2024-04-09: Initial publication