PT-2021-3713 · Fortinet · Fortiauthenticator

Published 2021-05-30 · Updated 2021-07-08 · CVE-2021-24005

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions FortiAuthenticator versions prior to 6.3.0

Description The issue is related to the use of hard-coded cryptographic keys in FortiAuthenticator, which can allow an attacker with access to certain files or the CLI configuration to decrypt sensitive data. This is possible because the system uses predetermined cryptographic keys to encrypt configuration files and debug logs.

Recommendations For versions prior to 6.3.0, update to version 6.3.0 or later to resolve the issue. As a temporary workaround, consider restricting access to configuration files and the CLI configuration to minimize the risk of exploitation. Avoid using the hard-coded cryptographic keys in the affected configuration files and debug logs until the issue is resolved.

Fix

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

CWE-321

Related Identifiers

BDU:2021-03953

CVE-2021-24005

Affected Products

Fortiauthenticator

References · 6

• https://bdu.fstec.ru/vul/2021-03953 · Security Note
• https://osv.dev/vulnerability/CVE-2021-24005 · Vendor Advisory
• https://fortiguard.com/psirt/FG-IR-20-049 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-24005 · Security Note
• https://cybersecurity-help.cz/vdb/SB2021060139 · Note
• https://t.me/cvenotify/17119 · Telegram Post