PT-2021-6855 · Fortinet · Fortios

Published 2021-01-25 · Updated 2021-12-09 · CVE-2021-26108

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions FortiOS versions prior to 7.0.1

Description A use of hard-coded cryptographic key vulnerability in the SSLVPN of FortiOS may allow an attacker to retrieve the key by reverse engineering. This issue is related to the use of a hard-coded cryptographic key in the SSL-VPN portal of FortiOS, which can be exploited by a remote attacker to obtain the encryption key.

Recommendations For FortiOS versions prior to 7.0.1, update to version 7.0.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the SSLVPN portal until a patch is applied. Avoid using the SSLVPN portal for sensitive operations until the issue is resolved.

Fix

Using Hardcoded Credentials

Weakness Enumeration

CWE-321

CWE-798

Related Identifiers

BDU:2022-02331

CVE-2021-26108

Affected Products

Fortios

References · 11

• https://bdu.fstec.ru/vul/2022-02331 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-26108 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-26108 · Security Note
• https://fortiguard.com/advisory/FG-IR-21-051 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-26108 · Vendor Advisory
• https://fortiguard.fortinet.com/psirt/FG-IR-21-051 · Note
• https://t.me/cibsecurity/33585 · Telegram Post
• https://cybersecurity-help.cz/vdb/SB2021120714 · Note
• https://vuldb.com/ru/?id.187774 · Note
• https://t.me/cvenotify/24411 · Telegram Post
• https://fortiguard.com/psirt/FG-IR-21-051 · Note