Paper/Archive/CVE-2021-26088

CVE-2021-26088

Fortinet Fortinet FSSO Windows DC Agent, FSSO Windows CA — An improper authentication vulnerability in FSSO Collector version 5.0.295 and below may allow an unauthenticated user to bypass a FSSO f…

EPSS 1%CVSS 9.6

critical.is priorityof 100

CVSS 9.6 (NVD)9.6 / 10 × 3028.8 Not in CISA KEV+300.0 EPSS percentile 63.8.638 × 2012.8 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

An improper authentication vulnerability in FSSO Collector version 5.0.295 and below may allow an unauthenticated user to bypass a FSSO firewall policy and access the protected network via sending specifically crafted UDP login notification packets.

Affected

ProductAffectedFixed inSource

Fortinet FSSO Windows DC Agent, FSSO Windows CAFSSO Windows DC Agent 5.0.295, 5.0.294; FSSO Windows CA 5.0.295, 5.0.294–CNA

Scores by source

NVD9.6CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

fortinet (CNA)7.1CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L

CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: partial

References

reffortiguard.com/advisory/FG-IR-20-191