Junglewise Threat Intelligence

CVE-2019-5591: Fortinet FortiOS Default Configuration Vulnerability

CVE-2019-5591 · Severity: critical · CVSS 6.5 · Exploited in the wild · Published 2021-11-03

Technologies: Fortinet FortiOS. Vendors: Fortinet.

Executive brief

A default configuration vulnerability in Fortinet FortiOS allows an unauthenticated attacker on the same subnet to intercept sensitive information. This is achieved by impersonating the LDAP server due to missing authentication for critical functions.

Affected products

  • Fortinet FortiOS up to and including 6.2.0

Timeline

  • 2020-08-14: disclosed: NVD Published Date
  • 2021-11-03: kev added: Date added to CISA Known Exploited Vulnerabilities Catalog
  • 2021-11-03: advisory: CISA advisory publication date

Related threats