CVE-2019-5591: medium-severity vulnerability in Fortinet FortiOS
Published · Updated
Patch now. It under exploitation confirmed by CISA, has a working public exploit and 1 threat group(s) use it.
Groups known to exploit this vulnerability (MITRE ATT&CK attribution).
Apply updates per vendor instructions.
FortiOS has a default configuration that allows an attacker on the same network to pretend to be an LDAP server and intercept sensitive information like login credentials. This happens because the system doesn't properly verify the server's identity.
A missing authentication weakness in FortiOS default configuration enables an unauthenticated attacker on the local subnet to perform LDAP server impersonation attacks without prerequisite authentication, leading to interception of sensitive data transmitted during LDAP authentication exchanges.
The full analysis of this CVE is available in Portuguese →
In the same product, most dangerous first.