Actively exploited · Published Jul 24, 2020 · Assigned by fortinet

CVE-2020-12812

High 7.5 Exploited Ransomware

In plain English

A high-severity improper authentication in Fortinet FortiOS. Attackers are actively exploiting it in the wild (listed by CISA on November 3, 2021). It has been used in ransomware campaigns. The chance it is exploited in the next 30 days is estimated at 45.4% (higher than 99% of all known vulnerabilities). Apply updates per vendor instructions.

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)45.4%top 1.2% of all CVEs

Exploited in the wildYesCISA KEV since Nov 3, 2021

Attack toolingNoneno public tooling known

CISA guidance

Apply updates per vendor instructions.

Federal agencies must remediate by May 3, 2022.

Official description

An improper authentication vulnerability in SSL VPN in FortiOS 6.4.0, 6.2.0 to 6.2.3, 6.0.9 and below may result in a user being able to log in successfully without being prompted for the second factor of authentication (FortiToken) if they changed the case of their username.

Affected products (as reported)

Vendor	Product	Versions
n/a	Fortinet FortiOS	FortiOS 6.4.0, 6.2.0 to 6.2.3, 6.0.9 and below

Weakness: CWE-287 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References

https://fortiguard.com/psirt/FG-IR-19-283 x_refsource_MISC
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-12812 government-resource