CVE-2020-12812: high-severity vulnerability in Fortinet FortiOS
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
Prioritize patching. It under exploitation confirmed by CISA and 2 threat group(s) use it.
Groups known to exploit this vulnerability (MITRE ATT&CK attribution).
Apply updates per vendor instructions.
A flaw in Fortinet's SSL VPN allows users to bypass two-factor authentication by simply changing the case (uppercase/lowercase) of their username. This is critical because it lets attackers gain unauthorized access to protected networks without needing the second authentication factor.
An improper authentication vulnerability exists in FortiOS SSL VPN where case-sensitive username validation is not properly enforced during second-factor authentication checks. An unauthenticated attacker can bypass FortiToken requirement by submitting credentials with altered username case, completely circumventing the multi-factor authentication mechanism.
The full analysis of this CVE is available in Portuguese →