CVE-2019-5591
Fortinet FortiOS Default Configuration Vulnerability
Published Aug 14, 2020 · updated Aug 14, 2026 · fortinet fortios
Fortinet FortiOS contains a default configuration vulnerability that may allow an unauthenticated attacker on the same subnet to intercept sensitive information by impersonating the Lightweight Directory Access Protocol (LDAP) server.
Timeline
Detection, updates, and resolution for this record.
Aug 14, 2020 · Catalog
Detected
Fortinet FortiOS contains a default configuration vulnerability that may allow an unauthenticated attacker on the same subnet to intercept sensitive information by impersonating the Lightweight Directory Access Protocol (LDAP) server.
Nov 3, 2021 · CISA KEV
Known exploited
Apply updates per vendor instructions.
May 3, 2022 · CISA KEV
Remediation due
Apply updates per vendor instructions.
Aug 14, 2026 · Catalog
Updated
Fortinet FortiOS contains a default configuration vulnerability that may allow an unauthenticated attacker on the same subnet to intercept sensitive information by impersonating the Lightweight Directory Access Protocol (LDAP) server.
Required action
Apply updates per vendor instructions.
CISA due date May 3, 2022
Affected
- cpe fortinet/fortiosversion unspecified
- vendor Fortinet FortiOSversion unspecified
Sources
- CISA KEVCVE-2019-5591
Fortinet FortiOS contains a default configuration vulnerability that may allow an unauthenticated attacker on the same subnet to intercept sensitive information by impersonating the Lightweight Directory Access Protocol (LDAP) server.
cisa.gov - CVE.orgCVE-2019-5591
Official CVE identifier
cve.org - FIRST EPSSCVE-2019-5591
30-day exploitation probability 18.6%
first.org - NIST NVDCVE-2019-5591
A Default Configuration vulnerability in FortiOS may allow an unauthenticated attacker on the same subnet to intercept sensitive information by impersonating the LDAP server.
nvd.nist.gov