Fortinet on Wednesday stated it noticed “current abuse” of a five-year-old security flaw in FortiOS SSL VPN within the wild beneath sure configurations.
The vulnerability in query is CVE-2020-12812 (CVSS rating: 5.2), an improper authentication vulnerability in SSL VPN in FortiOS that might permit a consumer to log in efficiently with out being prompted for the second issue of authentication if the case of the username was modified.
“This occurs when two-factor authentication is enabled within the ‘consumer native’ setting, and that consumer authentication kind is ready to a distant authentication technique (eg, LDAP),” Fortinet famous in July 2020. “The difficulty exists due to inconsistent case-sensitive matching among the many native and distant authentication.”
The vulnerability has since come beneath energetic exploitation within the wild by a number of risk actors, with the U.S. authorities additionally itemizing it as one of many many weaknesses that have been weaponized in assaults focusing on perimeter-type gadgets in 2021.
In a recent advisory issued December 24, 2025, Fortinet famous that efficiently triggering CVE-2020-12812 requires the next configuration to be current –
- Native consumer entries on the FortiGate with 2FA, referencing again to LDAP
- The identical customers have to be members of a bunch on the LDAP server
- Not less than one LDAP group the two-factor customers are a member of must be configured on FortiGate, and the group must be utilized in an authentication coverage which might embrace for instance administrative customers, SSL, or IPSEC VPN
If these stipulations are glad, the vulnerability causes LDAP customers with 2FA configured to bypass the security layer and as a substitute authenticate in opposition to LDAP straight, which, in flip, is the results of FortiGate treating usernames as case-sensitive, whereas the LDAP Listing doesn’t.
“If the consumer logs in with ‘Jsmith’, or ‘jSmith’, or ‘JSmith’, or ‘jsmiTh’ or something that’s NOT an actual case match to ‘jsmith,’ the FortiGate is not going to match the login in opposition to the native consumer,” Fortinet defined. “This configuration causes FortiGate to think about different authentication choices. The FortiGate will examine by means of different configured firewall authentication insurance policies.”
“After failing to match jsmith, FortiGate finds the secondary configured group ‘Auth-Group’, and from it the LDAP server, and supplied the credentials are right, authentication might be profitable no matter any settings throughout the native consumer coverage (2FA and disabled accounts).”
In consequence, the vulnerability can authenticate admin or VPN customers with out 2FA. Fortinet launched FortiOS 6.0.10, 6.2.4, and 6.4.1 to handle the conduct in July 2020. Organizations that haven’t deployed these variations can run the under command for all native accounts to stop the authentication bypass subject –
set username-case-sensitivity disable
Clients who’re on FortiOS variations 6.0.13, 6.2.10, 6.4.7, 7.0.1, or later are suggested to run the next command –
set username-sensitivity disable
“With username-sensitivity set to disabled, FortiGate will deal with jsmith, JSmith, JSMITH, and all attainable combos as similar and due to this fact stop failover to every other misconfigured LDAP group setting,” the corporate stated.
As extra mitigation, it is price contemplating eradicating the secondary LDAP Group if it isn’t required, as this eliminates your entire line of assault since no authentication through LDAP group might be attainable, and the consumer will fail authentication if the username just isn’t a match to a neighborhood entry.
Nonetheless, the newly issued steering doesn’t give any specifics on the character of the assaults exploiting the flaw, nor whether or not any of these incidents have been profitable. Fortinet has additionally suggested impacted prospects to contact its assist crew and reset all credentials in the event that they discover proof of admin or VPN customers being authenticated with out 2FA.
