CVE-2020-12812

KEV · Ransomware

Fortinet FortiOS SSL VPN Improper Authentication Vulnerability

Vendor / Project: Fortinet
Product: FortiOS
Date added: Nov 3, 2021
Due date: May 3, 2022
Known ransomware use: Known
CWEs: CWE-178, CWE-287

Description

Fortinet FortiOS SSL VPN contains an improper authentication vulnerability that may allow a user to login successfully without being prompted for the second factor of authentication (FortiToken) if they change the case in their username.

Required action

Apply updates per vendor instructions.

Notes

https://nvd.nist.gov/vuln/detail/CVE-2020-12812