ZeroDay Findings
Sign inSign up

Findings

CVE-2020-12812

Fortinet FortiOS SSL VPN Improper Authentication Vulnerability

Published Jul 24, 2020 · updated Oct 2, 2026 · fortinet fortios

An improper authentication vulnerability in SSL VPN in FortiOS 6.4.0, 6.2.0 to 6.2.3, 6.0.9 and below may result in a user being able to log in successfully without being prompted for the second factor of authentication (FortiToken) if they changed the case of their username.

Timeline

Detection, updates, and resolution for this record.

  1. Jul 24, 2020 · Catalog

    Detected

    An improper authentication vulnerability in SSL VPN in FortiOS 6.4.0, 6.2.0 to 6.2.3, 6.0.9 and below may result in a user being able to log in successfully without being prompted for the second factor of authentication (FortiToken) if they changed the case of their username.

  2. Nov 3, 2021 · CISA KEV

    Known exploited

    Apply updates per vendor instructions.

  3. May 3, 2022 · CISA KEV

    Remediation due

    Apply updates per vendor instructions.

  4. Oct 2, 2026 · Catalog

    Updated

    An improper authentication vulnerability in SSL VPN in FortiOS 6.4.0, 6.2.0 to 6.2.3, 6.0.9 and below may result in a user being able to log in successfully without being prompted for the second factor of authentication (FortiToken) if they changed the case of their username.

Required action

Apply updates per vendor instructions.

CISA due date May 3, 2022

Affected

  • cpe fortinet/fortiosversion unspecified
  • cpe fortinet/fortios6.4.0
  • vendor Fortinet FortiOSversion unspecified

Sources

  • CISA KEVCVE-2020-12812

    Fortinet FortiOS SSL VPN contains an improper authentication vulnerability that may allow a user to login successfully without being prompted for the second factor of authentication (FortiToken) if they change the case in their username.

    cisa.gov
  • CVE.orgCVE-2020-12812

    Official CVE identifier

    cve.org
  • FIRST EPSSCVE-2020-12812

    30-day exploitation probability 45.4%

    first.org
  • NIST NVDCVE-2020-12812

    An improper authentication vulnerability in SSL VPN in FortiOS 6.4.0, 6.2.0 to 6.2.3, 6.0.9 and below may result in a user being able to log in successfully without being prompted for the second factor of authentication (FortiToken) if they changed the case of their username.

    nvd.nist.gov

References