Fortinet FortiOS Default Configuration Vulnerability

Published Nov 3, 2021·Updated Aug 15, 2026

NVD Description

Fortinet FortiOS contains a default configuration vulnerability that may allow an unauthenticated attacker on the same subnet to intercept sensitive information by impersonating the Lightweight Directory Access Protocol (LDAP) server.

Public Exploits & PoCs1 found

[POC] CVE-2019-5591 — fortios-ldap-mitm-poc-CVE-2019-5591

The default configuration of LDAP on FortiOS v6.0.x to v6.2.0 does not check server identity for LDAP/S leading to MITM attacks. This PoC demos full exfiltration of credentials sent on the local subnet to an LDAP server that is easily impersonated.

References

View on NVD Search GitHub Search Google

Get alerted for CVEs like this

Start monitoring free