Actively exploited · Published Aug 14, 2020 · Assigned by fortinet

CVE-2019-5591

Medium 6.5 Exploited Ransomware

In plain English

A medium-severity missing authentication in Fortinet FortiOS from Fortinet. Attackers are actively exploiting it in the wild (listed by CISA on November 3, 2021). It has been used in ransomware campaigns. The chance it is exploited in the next 30 days is estimated at 18.6% (higher than 97% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei, public proof-of-concept code. Apply updates per vendor instructions.

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)18.6%top 2.7% of all CVEs

Exploited in the wildYesCISA KEV since Nov 3, 2021

Attack tooling2Nuclei, Public PoC

CISA guidance

Apply updates per vendor instructions.

Federal agencies must remediate by May 3, 2022.

Official description

A Default Configuration vulnerability in FortiOS may allow an unauthenticated attacker on the same subnet to intercept sensitive information by impersonating the LDAP server.

Affected products (as reported)

Vendor	Product	Versions
Fortinet	Fortinet FortiOS	FortiOS 6.2.0 and below.

Weakness: CWE-306 · Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References

https://www.fortiguard.com/psirt/FG-IR-19-037 x_refsource_CONFIRM
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-5591 government-resource