CVE-2020-12812

CRITICAL9.8

CISA KEV

Published 2020-07-24 · Updated 2026-08-12 · Source psirt@fortinet.com

Description

An improper authentication vulnerability in SSL VPN in FortiOS 6.4.0, 6.2.0 to 6.2.3, 6.0.9 and below may result in a user being able to log in successfully without being prompted for the second factor of authentication (FortiToken) if they changed the case of their username.

CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE-178CWE-287CWE-287

CISA Known-Exploited Vulnerability

Product: Fortinet — FortiOS

Name: Fortinet FortiOS SSL VPN Improper Authentication Vulnerability

Date added: 2021-11-03 · Due: 2022-05-03

USED IN RANSOMWARE

Required action: Apply updates per vendor instructions.

References

View on NVD

Related CVEs

Same severity, most recent

CVE-2026-87121
lwIP TCP/IP Stack MQTT is vulnerable to an out-of-bounds write, which may allow an attacker to gain full code execution on the device.
2026-09-22 · score 9.8
CVE-2026-76709
A vulnerability exists in the internal administrative component of Analytics and Location Engine (ALE). Successful exploitation of this vulnerability could allow an unauthenticated remote attacker to gain unauthorized write access to the file system with elevated privileges, potentially resulting in full system compromise.
2026-09-22 · score 9.8
CVE-2026-76708
A vulnerability exists in the Analytics and Location Engine (ALE) where the application and underlying operating system use default, hard-coded credentials for several administrative and system accounts. An unauthenticated remote attacker could exploit this vulnerability by attempting to log in using these known default credentials. Successful exploitation could result in an attacker gaining unauthorized access to the application's management interface and the underlying operating system, potentially leading to full system compromise.
2026-09-22 · score 9.8
CVE-2026-47116
LTSecurity LTK3500SF contains a hard-coded credentials vulnerability where root and guest account passwords are stored as reversible hashes in /etc/shadow, recoverable using dictionary-based cracking tools. Attackers can use the recovered credentials to authenticate via Telnet or SSH and obtain full root-level access to the operating system.
2026-09-22 · score 9.8
CVE-2026-28324
SolarWinds Observability Self-Hosted was found to be affected by an unauthenticated remote code execution vulnerability due to the insufficient integrity checks. Installations configured in a non-default and non-secure configuration are affected.
2026-09-22 · score 9.8