Description
An insufficiently protected credentials vulnerability [CWE-522] in FortiNAC-F 7.2.0, FortiNAC 9.4.1 and below, 9.2.6 and below, 9.1.8 and below, 8.8.0 all versions, 8.7.0 all versions may allow a local attacker with system access to retrieve users' passwords.
Published: 2023-05-03
Score: 3.9 Low
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

No analysis available yet.

Remediation

Vendor Solution

Please upgrade to FortiNAC-F version 7.2.1 or above Please upgrade to FortiNAC version 9.4.2 or above Please upgrade to FortiNAC version 9.2.7 or above After the upgrade, the CLI account password should be changed. To know which accounts require a new password, the following command can be run: grep ":\$1" /etc/shadow Then, login to the CLI with that user and type "passwd" to change the password and update the hash.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
EUVD EUVD EUVD-2022-48712 An insufficiently protected credentials vulnerability [CWE-522] in FortiNAC-F 7.2.0, FortiNAC 9.4.1 and below, 9.2.6 and below, 9.1.8 and below, 8.8.0 all versions, 8.7.0 all versions may allow a local attacker with system access to retrieve users' passwords.
References
Link Providers
https://fortiguard.com/psirt/FG-IR-22-456 cve-icon cve-icon
History

Tue, 22 Oct 2024 21:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Subscriptions

Fortinet Fortinac Fortinac-f
cve-icon MITRE

Status: PUBLISHED

Assigner: fortinet

Published:

Updated: 2024-10-22T20:46:40.435Z

Reserved: 2022-11-23T14:57:05.612Z

Link: CVE-2022-45859

cve-icon Vulnrichment

Updated: 2024-08-03T14:24:03.182Z

cve-icon NVD

Status : Modified

Published: 2023-05-03T22:15:15.553

Modified: 2024-11-21T07:29:51.237

Link: CVE-2022-45859

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses