FortiNAC - argument injection in XML interface on port tcp/5555

An improper neutralization of special elements used in a command ('command injection') vulnerability [CWE-77] in FortiNAC tcp/5555 service may allow an unauthenticated attacker to copy local files of the device to other local directories of the device via specially crafted input fields. To access the copied data, however, the attacker must have an already existing foothold on the device with sufficient privileges

access argument command command injection copy cwe data device files fortinac injection input interface local may port service special tcp vulnerability xml