description: A weak authentication vulnerability [CWE-1390] in FortiNAC-F version 7.2.0, FortiNAC version 9.4.2 and below, 9.2 all versions, 9.1 all versions, 8.8 all versions, 8.7 all versions in device registration page may allow an unauthenticated attacker to perform password spraying attacks with an increased chance of success.
problem types: Improper access control
affected:
{
vendor: Fortinet
product: FortiNAC
defaultStatus: unaffected
versions:
versionType: semver, version: 9.4.0, lessThanOrEqual: 9.4.2, status: affected
versionType: semver, version: 9.2.0, lessThanOrEqual: 9.2.6, status: affected
versionType: semver, version: 9.1.0, lessThanOrEqual: 9.1.9, status: affected
versionType: semver, version: 8.8.0, lessThanOrEqual: 8.8.11, status: affected
versionType: semver, version: 8.7.0, lessThanOrEqual: 8.7.6, status: affected
}
metrics:
format: CVSS
cvssV3_1: [
version: 3.1
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:F/RL:X/RC:R
]
solutions: Please upgrade to FortiNAC version 9.4.3 or above
Please upgrade to FortiNAC-F version 7.2.1 or above