PT-2020-6788 · Fortinet · Fortiguard+4

Published 2020-09-24 · Updated 2020-10-05 · CVE-2020-12818

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions FortiGate versions prior to 6.4.1

Description The issue is related to insufficient logging, which may allow traffic from an unauthenticated attacker to Fortinet owned IP addresses to go unnoticed. This is due to incorrect logging of traffic for a range of IP addresses. A remote attacker could exploit this to gain unauthorized access to protected information. Specifically, traffic destined to certain subnets, such as 173.243.128.0/20 and 96.45.32.0/20, may not be recorded, including traffic generated by FortiClient/FortiClient EMS requesting updates from FortiGuard distributed servers.

Recommendations For FortiGate versions prior to 6.4.1, update to version 6.4.1 or later to resolve the issue. As a temporary workaround, consider manually monitoring traffic logs for suspicious activity, especially for traffic destined to Fortinet owned IP addresses. Restrict access to the affected subnets to minimize the risk of exploitation.

Fix

Insertion into Log File

Weakness Enumeration

CWE-532

CWE-778

Related Identifiers

BDU:2022-06507

CVE-2020-12818

Affected Products

Forticlient

Forticlientems

Fortigate

Fortiguard

Fortios

References · 7

• https://bdu.fstec.ru/vul/2022-06507 · Security Note
• https://osv.dev/vulnerability/CVE-2020-12818 · Vendor Advisory
• https://fortiguard.com/advisory/FG-IR-20-033 · Vendor Advisory
• https://fortiguard.com/psirt/FG-IR-20-033 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-12818 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-12818 · Security Note
• https://fortiguard.fortinet.com/psirt/FG-IR-20-033 · Note