CVE-2022-26117: 
FortiNAC vulnerability analysis and mitigation

An empty password in configuration file vulnerability (CWE-258) was discovered in FortiNAC that affects multiple versions of the software. The vulnerability was disclosed on July 5, 2022, and assigned CVE-2022-26117. The affected versions include FortiNAC 8.3.7, 8.5.0 through 8.5.2, 8.5.4, 8.6.0, 8.6.2 through 8.6.5, 8.7.0 through 8.7.6, 8.8.0 through 8.8.11, 9.1.0 through 9.1.5, and 9.2.0 through 9.2.3 (Fortiguard PSIRT).

The vulnerability stems from an unprotected MySQL root account where the database used for FortiNAC has no password set. The MySQL database listens on localhost, and any local user can connect to the database using the root account. The vulnerability has been assigned a CVSS v3 score of 8.0, indicating high severity (Fortiguard PSIRT, Orange CERT-CC).

An authenticated attacker could access the MySQL databases via the CLI, potentially modifying or corrupting the database, which could make the solution unstable. Additionally, attackers could retrieve tokens stored in some tables. This vulnerability could lead to unauthorized execution of code or commands (Fortiguard PSIRT, Orange CERT-CC).

Fortinet has released patches to address this vulnerability. Users are advised to upgrade to FortiNAC version 10.0.0 or above, version 9.2.4 or above, or version 9.1.6 or above (Fortiguard PSIRT).