CVE-2022-26117: High severity fortinet fortinac vulnerability
An empty password in configuration file vulnerability [CWE-258] in FortiNAC version 8.3.7 and below, 8.5.2 and below, 8.5.4, 8.6.0, 8.6.5 and below, 8.7.6 and below, 8.8.11 and below, 9.1.5 and below, 9.2.3 and below may allow an authenticated attacker to access the MySQL databases via the CLI.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2022-26117?
CVE-2022-26117 is considered a medium severity vulnerability that allows authenticated attackers to access MySQL databases.
How do I fix CVE-2022-26117?
To fix CVE-2022-26117, ensure that the configuration file does not contain an empty password by updating the relevant settings.
Which versions of FortiNAC are affected by CVE-2022-26117?
CVE-2022-26117 affects FortiNAC versions 8.3.7 and below, 8.5.2 and below, 8.6.5 and below, 8.7.6 and below, 8.8.11 and below, 9.1.5 and below, and 9.2.3 and below.
What can an attacker do with CVE-2022-26117?
An attacker can exploit CVE-2022-26117 to gain unauthorized access to MySQL databases via the command-line interface.
Is there a patch for CVE-2022-26117?
Yes, patches or updates are available for FortiNAC that address the vulnerability in CVE-2022-26117.