description: Some cryptographic issues in Fortinet FortiNAC versions 9.4.0 through 9.4.1, 9.2.0 through 9.2.7, 9.1.0 through 9.1.8, 8.8.0 through 8.8.11, 8.7.0 through 8.7.6, 8.6.0 through 8.6.5, 8.5.0 through 8.5.4, 8.3.7 may allow an attacker to decrypt and forge protocol communication messages.
problem types: Information disclosure
affected:
{
vendor: Fortinet
product: FortiNAC
defaultStatus: unaffected
versions:
versionType: semver, version: 9.4.0, lessThanOrEqual: 9.4.1, status: affected
versionType: semver, version: 9.2.0, lessThanOrEqual: 9.2.7, status: affected
versionType: semver, version: 9.1.0, lessThanOrEqual: 9.1.8, status: affected
versionType: semver, version: 8.8.0, lessThanOrEqual: 8.8.11, status: affected
versionType: semver, version: 8.7.0, lessThanOrEqual: 8.7.6, status: affected
versionType: semver, version: 8.6.0, lessThanOrEqual: 8.6.5, status: affected
versionType: semver, version: 8.5.0, lessThanOrEqual: 8.5.4, status: affected
version: 8.3.7, status: affected
}
metrics:
format: CVSS
cvssV3_1: [
version: 3.1
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N/E:U/RL:U/RC:C
]
solutions: Please upgrade to FortiNAC version 9.4.2 or above
Please upgrade to FortiNAC version 7.2.0 or above