FortiNAC - argument injection in XML interface on port tcp/5555 Fortinet PSIRT Advisories Fortinet PSIRT Contact: Website: https://fortiguard.fortinet.com/faq/psirt-contact FG-IR-23-096 Final 1 1 2023-06-23T00:00:00 Current version 2023-06-23T00:00:00 2023-06-23T00:00:00 An improper neutralization of special elements used in a command ('command injection') vulnerability [CWE-77] in FortiNAC tcp/5555 service may allow an unauthenticated attacker to copy local files of the device to other local directories of the device via specially crafted input fields. To access the copied data, however, the attacker must have an already existing foothold on the device with sufficient privileges None Improper access control Fortinet is pleased to thank Florian Hauser from CODE WHITE for reporting this vulnerability under responsible disclosure. FortiNAC 9.4.3 FortiNAC 9.4.2 FortiNAC 9.4.1 FortiNAC 9.4.0 FortiNAC 7.2.1 FortiNAC 7.2.0 CVE-2023-33300 FortiNAC-9.4.3 FortiNAC-9.4.2 FortiNAC-9.4.1 FortiNAC-9.4.0 FortiNAC-7.2.1 FortiNAC-7.2.0 4.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R https://fortiguard.fortinet.com/psirt/FG-IR-23-096 FortiNAC - argument injection in XML interface on port tcp/5555 Reference>