PT-2022-12006 · Fortinet · Fortitoken Mobile

Published 2022-03-02 · Updated 2022-03-11 · CVE-2021-44166

Positive Technologies (AI Summary)

CVSS v3.1

4.1

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions FortiToken Mobile (Android) versions 5.1.0 and below

Description An improper access control issue may allow a remote attacker, who has already obtained a user's password, to access the protected system during the 2FA procedure, even if the deny button is clicked by the legitimate user. This occurs in the external push notification feature.

Recommendations For versions 5.1.0 and below, update to a version above 5.1.0 to resolve the issue. As a temporary workaround, consider restricting access to the external push notification feature until a patch is available.

Fix

Related Identifiers

CVE-2021-44166

Affected Products

Fortitoken Mobile

References · 5

• https://osv.dev/vulnerability/CVE-2021-44166 · Vendor Advisory
• https://fortiguard.com/psirt/FG-IR-21-210 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-44166 · Security Note
• https://t.me/cibsecurity/38289 · Telegram Post
• https://t.me/cvenotify/27596 · Telegram Post