This vulnerability in Fortinet FortiNAC-F products involves an Open Redirect (CWE-601) flaw that can be exploited by a remote attacker holding system administrator privileges. By crafting a malicious CSV file, the attacker can cause the system to redirect users to untrusted external websites. The affected versions include FortiNAC-F 7.6.0 through 7.6.5, 7.4 all versions, and 7.2 all versions. The CVSS v3.1 base score is 2.2, indicating low severity with partial impact on integrity and requiring user interaction. The vendor has released an official fix for this vulnerability.

The vulnerability allows a privileged remote attacker to redirect users to arbitrary external websites, which could potentially be used for phishing or other social engineering attacks. There is no direct impact on confidentiality or availability. The attack requires the attacker to have system administrator privileges and user interaction to succeed. No known exploits are reported in the wild.

An official patch is available from Fortinet to remediate this vulnerability. Users of affected FortiNAC-F versions should apply the vendor's update promptly to eliminate the risk. Since the vulnerability requires system administrator privileges and user interaction, applying the patch effectively mitigates the threat.