Database/Control plane, storage & DevOps

Fortinet FortiOS SSL-VPN: A logic flaw lets a user who changes their login case (e.g

CVSS 9.8CVE-2020-12812Control plane, storage & DevOpsKnown exploitedFG-IR-19-283curated

Impact

A logic flaw lets a user who changes their login case (e.g. 'User' vs 'user') complete SSL-VPN authentication without ever being prompted for their second factor — a clean bypass of FortiToken MFA on the VPN gateway. Confirmed in CISA's KEV catalog as actively exploited; if this FortiGate is the VPN entry point into a cluster's management network, MFA was supposed to be the thing stopping a stolen password from being enough.

Who can reach it

Requires a valid username/password (e.g. phished or reused) but no second factor — the attacker just varies the case of the username at login to skip the FortiToken prompt.

What to do

Firmware upgrade to the fixed FortiOS release per Fortinet PSIRT FG-IR-19-283. Given confirmed active exploitation, patch ahead of routine cycles, and afterward force a credential rotation for any accounts that authenticated to SSL-VPN during the vulnerable window in case MFA was bypassed on them already.

References

https://fortiguard.com/psirt/FG-IR-19-283 https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-12812

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.