CVE-2019-5591
Fortinet FortiOS Default Configuration Vulnerability
Description
CVE-2019-5591 is a MEDIUM default configuration vulnerability in Fortinet FortiOS, carrying a CVSS 3.1 score of 6.5. The vulnerability allows an unauthenticated attacker on the same subnet to intercept sensitive information by impersonating the Lightweight Directory Access Protocol (LDAP) server due to a default configuration weakness. Affected products include Fortinet FortiOS versions up to and including 6.2.0. This CVE is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog with a remediation deadline of 2022-05-03. With an EPSS score of 0.48360 (97.69th percentile), this vulnerability demonstrates significant real-world exploitation likelihood and should be addressed promptly.
KEV Information
CVSS Score
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| fortinet | fortios | <= 6.2.0 |
Multiple CVSS Assessments
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
References
- https://www.fortiguard.com/psirt/FG-IR-19-037(Mitigation, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-5591(US Government Resource)
Weakness Type
CWE-306: Missing Authentication for Critical Function
CVE-2019-5591 is classified under CWE-306 — Missing Authentication for Critical Function. This weakness occurs when a product does not perform authentication for functionality that requires a provable user identity or consumes a significant amount of resources. Without proper authentication mechanisms, critical functions become accessible to unauthorized actors who can exploit them to bypass security controls, access sensitive data, or perform privileged operations.
In the context of Fortinet FortiOS, the missing authentication manifests as a default configuration that does not verify the identity of the LDAP server when establishing connections. This allows an attacker on the same network subnet to set up a rogue LDAP server and intercept authentication traffic, including user credentials and directory information. The default configuration trust model assumes network-level isolation provides sufficient security, but adjacent network access (which could be achieved through other compromises or insider threats) breaks this assumption.
Learn more: CWE-306 — Missing Authentication for Critical Function
Impact Analysis
CVE-2019-5591 carries a CVSS 3.1 score of 6.5 (MEDIUM) with Unchanged Scope.
Confidentiality (HIGH): Successful exploitation allows an attacker to intercept all LDAP traffic between the FortiOS device and the legitimate LDAP server, including user credentials, authentication tokens, and directory queries. This can expose credentials for all users who authenticate through the FortiOS device.
Integrity (NONE): The vulnerability does not directly enable modification of data or system configurations. The attack is focused on interception rather than manipulation of information.
Availability (NONE): The vulnerability does not directly impact the availability of the FortiOS device or its services. The legitimate LDAP authentication flow may continue to function while credentials are intercepted.
With an EPSS score of 0.48360 (97.69th percentile), this vulnerability has significant exploitation likelihood despite its medium severity rating, particularly when combined with other Fortinet vulnerabilities in chained attack scenarios.
Exploit Maturity
CVE-2019-5591 has confirmed active exploitation and is listed in CISA's Known Exploited Vulnerabilities catalog.
Exploit status: This vulnerability has been exploited in the wild, particularly in combination with other Fortinet vulnerabilities such as CVE-2018-13379 and CVE-2020-12812 to form comprehensive attack chains against FortiOS deployments. The EPSS score of 0.48360 (97.69th percentile) reflects significant exploitation activity.
Ransomware association: No direct ransomware association has been confirmed for CVE-2019-5591 in the KEV data. However, its use in combination with other Fortinet vulnerabilities that do have ransomware associations makes it a component of broader threat campaigns.
Attack surface: Exploitation requires the attacker to be on the same subnet as the FortiOS device, which limits the attack surface compared to remotely exploitable vulnerabilities. However, in environments where network segmentation is insufficient, this requirement may be easily met.
KEV deadline: CISA required federal agencies to remediate this vulnerability by 2022-05-03.
Remediation
- Apply vendor updates and configuration changes. Apply updates per vendor instructions. Consult the Fortinet advisory at fortiguard.com/psirt/FG-IR-19-037 for specific guidance. Update FortiOS beyond version 6.2.0.
- Configure LDAP server identity verification. Explicitly configure FortiOS to verify the LDAP server's identity using certificate-based authentication (LDAPS) or other server verification mechanisms. Do not rely on the default configuration.
- Implement network segmentation. Ensure the FortiOS management and LDAP communication occurs on isolated, secured network segments. Restrict which devices can communicate on these management VLANs.
- Enable LDAP over TLS/SSL. Configure LDAPS (LDAP over SSL) to encrypt LDAP communications and authenticate the LDAP server using certificates, preventing man-in-the-middle attacks.
- Monitor for LDAP anomalies. Implement monitoring for unexpected LDAP server responses, certificate changes, or suspicious ARP activity on management network segments.
- Audit all FortiOS configurations. Review default configurations across all FortiOS deployments to identify and remediate other potential default configuration weaknesses.
Technical Details
CVE-2019-5591 is a MEDIUM-severity vulnerability in Fortinet FortiOS that requires adjacent network access for exploitation. The attack complexity is low, no privileges are required, and no user interaction is needed.
Technical mechanism: The vulnerability resides in the default LDAP configuration of FortiOS, which does not verify the identity of the LDAP server during connection establishment. When FortiOS initiates an LDAP connection for user authentication, it does not validate the server's certificate or identity by default. An attacker on the same subnet can exploit this by setting up a rogue LDAP server and using techniques such as ARP spoofing or DNS manipulation to redirect the FortiOS device's LDAP queries to their malicious server. This allows interception of credentials and other sensitive directory information.
CVSS 3.1 vector analysis: The vector CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N reflects an adjacent network attack vector (requiring same-subnet access), low complexity, no privileges, no user interaction, high confidentiality impact, but no integrity or availability impact. The Unchanged scope means the impact is confined to the FortiOS device.
Affected versions: FortiOS versions up to and including 6.2.0.
Frequently Asked Questions
Is CVE-2019-5591 being actively exploited?
Yes, CVE-2019-5591 has been exploited in the wild, particularly in combination with other Fortinet vulnerabilities such as CVE-2018-13379 and CVE-2020-12812. It is listed in CISA's KEV catalog with an EPSS score of 0.48360 (97.69th percentile) indicating significant exploitation likelihood.
What products are affected by CVE-2019-5591?
Fortinet FortiOS versions up to and including 6.2.0 are affected. The vulnerability exists in the default LDAP configuration that does not verify LDAP server identity during connection establishment.
How do I fix CVE-2019-5591?
Update FortiOS beyond version 6.2.0 and configure LDAP server identity verification using certificate-based authentication (LDAPS). Do not rely on default configurations. Implement network segmentation for LDAP communication channels. Consult Fortinet advisory FG-IR-19-037.
How severe is CVE-2019-5591?
CVE-2019-5591 is rated MEDIUM with a CVSS 3.1 score of 6.5. While requiring adjacent network access limits remote exploitation, it enables credential interception when exploited. Its inclusion in CISA's KEV catalog and EPSS score of 0.48360 (97.69th percentile) confirm real-world exploitation, especially as part of chained attacks against FortiOS.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.