CVE-2023-33299: Critical Fortinet FortiNAC RCE Vulnerability

On June 23, 2023, Fortinet disclosed a critical Remote Code Execution (RCE) vulnerability (CVE-2023-33299) affecting FortiNAC, a network access control solution utilized by organizations to manage network access policies and compliance.

This vulnerability is the result of the deserialization of untrusted data. Deserialization vulnerabilities such as this one are dangerous because a threat actor can insert a modified serialized object into the system which leads to unauthenticated RCE.

Fortinet products are an attractive target for threat actors due to the level of access on a network a threat actor can achieve once a system is compromised. Additionally, Fortinet products have a large presence in enterprise networks globally which allow threat actors to target organizations across multiple industries.

Recommendation

Apply the Latest Security Patches Released by Fortinet

Arctic Wolf strongly recommends updating FortiNAC to the following versions outlined in the table below to remediate the newly disclosed vulnerability.

Note: Arctic Wolf recommends the following change management best practices for deploying security patches, including testing changes in a dev environment before deploying to production to avoid operational impact.

References

• Fortinet Advisory