Insufficient Credential Protection in Fortinet FortiNAC Software
CVE-2022-40678

7.4HIGH

Key Information:

Vendor

Fortinet
Status
Fortinac
Vendor
CVE Published:
16 February 2023

What is CVE-2022-40678?

An issue in Fortinet FortiNAC allows local attackers with access to the database to exploit insufficiently protected credentials, potentially enabling them to recover user passwords. This poses a significant risk to data security and requires immediate attention to safeguard sensitive information.

Affected Version(s)

FortiNAC 9.4.0

FortiNAC 9.2.0 <= 9.2.5

FortiNAC 9.1.0 <= 9.1.7

References

https://fortiguard.com/psirt/FG-IR-22-265

CVSS V3.1

Score:
7.4
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.