CVE-2020-12812
Fortinet FortiOS SSL VPN Improper Authentication Vulnerability
Description
CVE-2020-12812 is a CRITICAL improper authentication vulnerability in Fortinet FortiOS SSL VPN, carrying a CVSS 3.1 score of 9.8. The vulnerability allows a user to log in successfully to the SSL VPN without being prompted for the second factor of authentication (FortiToken) if they change the case of their username. This authentication bypass effectively defeats two-factor authentication protections. Affected products include Fortinet FortiOS versions before 6.0.10, versions 6.2.0 through 6.2.3, and version 6.4.0. This CVE is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog with a remediation deadline of 2022-05-03. With an EPSS score of 0.47037 (97.63th percentile), this vulnerability demonstrates significant real-world exploitation activity.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| fortinet | fortios | < 6.0.10; >= 6.2.0, < 6.2.4; 6.4.0 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://fortiguard.com/psirt/FG-IR-19-283(Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-12812(US Government Resource)
Weakness Type
CWE-178: Improper Handling of Case Sensitivity
CVE-2020-12812 is classified under CWE-178 — Improper Handling of Case Sensitivity. This weakness occurs when software does not properly account for differences between uppercase and lowercase characters when performing security-relevant comparisons or lookups. If authentication systems treat uppercase and lowercase versions of the same username as different identities for some operations but the same identity for others, attackers can exploit this inconsistency to bypass security controls.
CWE-287: Improper Authentication
CVE-2020-12812 is additionally classified under CWE-287 — Improper Authentication. This weakness occurs when an actor claims to have a given identity but the product does not prove or insufficiently proves that the claim is correct. In this case, the authentication system fails to enforce two-factor authentication consistently, allowing attackers to bypass the second authentication factor entirely.
In the context of Fortinet FortiOS SSL VPN, the combination of case sensitivity mishandling and improper authentication creates a critical bypass. When a user changes the case of their username (e.g., from "user" to "User" or "USER"), the system recognizes them as the same user for login purposes but fails to enforce the FortiToken two-factor authentication requirement. This effectively reduces multi-factor authentication to single-factor authentication.
Learn more: CWE-178 — Improper Handling of Case Sensitivity
Impact Analysis
CVE-2020-12812 carries a CVSS 3.1 score of 9.8 (CRITICAL) with Unchanged Scope.
Confidentiality (HIGH): Successful exploitation bypasses two-factor authentication on the FortiOS SSL VPN, granting attackers full VPN access with only stolen or guessed credentials. This provides access to all internal network resources available through the VPN, including sensitive corporate data, internal applications, and network infrastructure.
Integrity (HIGH): With VPN access, attackers can modify internal systems, deploy malware, alter configurations, and establish persistent access to the enterprise network. The bypassed authentication undermines the entire trust model of the VPN infrastructure.
Availability (HIGH): Attackers with VPN access can disrupt internal services, deploy ransomware, or conduct destructive operations across the internal network. The VPN access provides a foothold for lateral movement to critical infrastructure.
With an EPSS score of 0.47037 (97.63th percentile), this vulnerability has high exploitation likelihood, especially in combination with credential theft or other Fortinet vulnerabilities.
Exploit Maturity
CVE-2020-12812 has confirmed active exploitation in the wild and is listed in CISA's Known Exploited Vulnerabilities catalog.
Exploit status: This vulnerability has been actively exploited, often in combination with CVE-2018-13379 (FortiOS path traversal enabling credential theft) and CVE-2019-5591 (LDAP default configuration). Together, these vulnerabilities form a complete attack chain: steal VPN credentials, bypass 2FA, and gain network access. The EPSS score of 0.47037 (97.63th percentile) confirms significant exploitation.
Ransomware association: CVE-2020-12812 has been confirmed as associated with ransomware campaigns. Ransomware operators have used this vulnerability to bypass 2FA on FortiOS VPNs as part of their initial access strategy for deploying ransomware within enterprise networks.
Attack surface: The FortiOS SSL VPN is frequently internet-facing, providing a large attack surface. The exploitation is trivial — simply changing the case of a username bypasses 2FA. No specialized tools or exploit code is needed.
KEV deadline: CISA required federal agencies to remediate this vulnerability by 2022-05-03.
Remediation
- Apply vendor patches immediately. Apply updates per vendor instructions. Consult the Fortinet advisory at fortiguard.com/psirt/FG-IR-19-283. Update to FortiOS 6.0.10 or later, 6.2.4 or later, or 6.4.1 or later.
- Verify 2FA enforcement across all username variations. Test that two-factor authentication is properly enforced regardless of username case. Attempt login with different case variations to confirm the fix is effective.
- Audit VPN access logs for suspicious activity. Review SSL VPN authentication logs for successful logins where the username case differs from the configured account. Investigate any suspicious access patterns that may indicate exploitation.
- Implement additional authentication controls. Consider implementing certificate-based VPN authentication in addition to username/password and FortiToken. Deploy network access control (NAC) policies to verify device compliance.
- Rotate potentially compromised credentials. If the vulnerability may have been exploited, force password resets for all VPN users and re-enroll FortiToken second factors.
- Deploy defense-in-depth for VPN access. Implement anomaly-based monitoring for VPN sessions, enforce geographic access restrictions, and monitor for unusual access patterns or lateral movement following VPN connections.
Technical Details
CVE-2020-12812 is a CRITICAL-severity vulnerability in Fortinet FortiOS SSL VPN. The attack is network-based with low complexity, requiring no privileges and no user interaction.
Technical mechanism: The vulnerability exists in the SSL VPN authentication module of FortiOS. When two-factor authentication using FortiToken is configured, the system checks whether the authenticating user requires a second factor. However, this check is case-sensitive — it compares the provided username against the configured username in a case-sensitive manner. If the user changes the case of any character in their username (e.g., "admin" to "Admin"), the system still authenticates the user against the correct account (case-insensitive credential validation) but fails to match them against the 2FA requirement (case-sensitive policy lookup). This inconsistency between credential validation and policy enforcement allows complete bypass of FortiToken two-factor authentication.
CVSS 3.1 vector analysis: The vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H reflects network-based attack, low complexity, no privileges needed, no user interaction, and maximum CIA impact. The high CVSS score reflects that 2FA bypass combined with VPN access provides extensive capability.
Affected versions: FortiOS before 6.0.10, FortiOS 6.2.0 through 6.2.3, FortiOS 6.4.0.
Frequently Asked Questions
Is CVE-2020-12812 being actively exploited?
Yes, CVE-2020-12812 has been actively exploited, often in combination with other Fortinet vulnerabilities such as CVE-2018-13379 and CVE-2019-5591 to form complete attack chains. It is listed in CISA's KEV catalog with an EPSS score of 0.47037 (97.63th percentile). It has confirmed ransomware associations.
What products are affected by CVE-2020-12812?
Fortinet FortiOS versions before 6.0.10, versions 6.2.0 through 6.2.3, and version 6.4.0 are affected. The vulnerability exists in the SSL VPN authentication module where two-factor authentication can be bypassed by changing the case of the username.
How do I fix CVE-2020-12812?
Update to FortiOS 6.0.10 or later, 6.2.4 or later, or 6.4.1 or later. After patching, verify that 2FA is enforced regardless of username case. Audit VPN access logs for suspicious login activity and rotate credentials if compromise is suspected. Consult Fortinet advisory FG-IR-19-283.
How severe is CVE-2020-12812?
CVE-2020-12812 is rated CRITICAL with a CVSS 3.1 score of 9.8. It allows complete bypass of FortiToken two-factor authentication by simply changing the case of a username. The EPSS score of 0.47037 (97.63th percentile) confirms high exploitation rates. It has been used in ransomware campaigns targeting enterprise VPN infrastructure.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.