CyberRota Analysis
This is a critical severity vulnerability with a CVSS score of 9.8. It affects FortiOS. It is listed in CISA's Known Exploited Vulnerabilities catalog, indicating confirmed active exploitation in the wild. Its EPSS score suggests a 49.3% probability of exploitation in the next 30 days.
CISA KEV Details
Status: This CVE is listed in CISA's Known Exploited Vulnerabilities catalog.
Ransomware use: Known
Added to KEV: 2021-11-03
Required action: Apply updates per vendor instructions.
Original NVD Description
An improper authentication vulnerability in SSL VPN in FortiOS 6.4.0, 6.2.0 to 6.2.3, 6.0.9 and below may result in a user being able to log in successfully without being prompted for the second factor of authentication (FortiToken) if they changed the case of their username.
Related CVEs
Other vulnerabilities affecting the same vendor(s)