CVE-2023-33300: 
FortiNAC vulnerability analysis and mitigation

CVE-2023-33300 is a command injection vulnerability discovered in Fortinet FortiNAC's XML interface on port tcp/5555. The vulnerability affects FortiNAC versions 7.2.0 through 7.2.1 and 9.4.0 through 9.4.3. This security flaw was initially published on June 23, 2023, and was reported by Florian Hauser from CODE WHITE under responsible disclosure (Fortinet PSIRT).

The vulnerability is classified as an improper neutralization of special elements used in a command (CWE-77). It exists in the FortiNAC tcp/5555 service and has been assigned a CVSS v3.1 base score of 5.3 (Medium severity). The vulnerability allows an unauthenticated attacker to copy local files of the device to other local directories via specially crafted input fields in the inter-server communication port (Fortinet PSIRT, NVD).

The impact of this vulnerability is considered medium, primarily affecting file system integrity. However, to access the copied data, an attacker must have an already existing foothold on the device with sufficient privileges, which significantly limits the potential impact (Fortinet PSIRT).

Fortinet has released patches to address this vulnerability. Users of FortiNAC 9.4.x should upgrade to version 9.4.4 or above, while users of FortiNAC 7.2.x should upgrade to version 7.2.2 or above (Fortinet PSIRT).