Fortinet · FortiOS
CVE-2020-12812
Fortinet FortiOS SSL VPN Improper Authentication Vulnerability
概要
An improper authentication vulnerability in SSL VPN in FortiOS 6.4.0, 6.2.0 to 6.2.3, 6.0.9 and below may result in a user being able to log in successfully without being prompted for the second factor of authentication (FortiToken) if they changed the case of their username.
CISA: Fortinet FortiOS SSL VPN contains an improper authentication vulnerability that may allow a user to login successfully without being prompted for the second factor of authentication (FortiToken) if they change the case in their username.
対処法
Apply updates per vendor instructions.
米国連邦機関の対応期限：2022年5月3日
Fortinetのその他の悪用された脆弱性
| 追加日 | 脆弱性 | 製品 | 深刻度 | 攻撃の可能性 |
|---|---|---|---|---|
| 2026/07/27 | Exposure of Sensitive Information to an Unauthorized Actor | FortiOS | 中 5.3 | 29% |
| 2025/06/25 | Use of Hard-Coded Credentials | FortiOS | 中 6.5 | 6.6% |
| 2024/02/09 | Out-of-Bound Write | FortiOS | 緊急 9.6 | 85% |
| 2023/03/14 | Path Traversal | FortiOS | 中 6.5 | 11% |
| 2022/12/13 | Heap-Based Buffer Overflow | FortiOS | 緊急 9.3 | 99.5% |
| 2021/12/10 | Arbitrary File Download | FortiOS | 低 3.3 | 0.9% |
| 2021/11/03 | Default Configuration | FortiOS | 中 6.5 | 19% |
| 2021/11/03 | SSL VPN Path Traversal | FortiOS | 緊急 9.1 | >99.9% |
出典：Known Exploited Vulnerabilities（CISA、パブリックドメイン）、CVE records（cve.org）、EPSS（FIRST）。攻撃の可能性は、今後30日以内に誰かがその脆弱性の悪用を試みるというEPSSの推定値です。