CVE-2021-26108

Name of the Vulnerable Software and Affected Versions FortiOS versions prior to 7.0.1

Description A use of hard-coded cryptographic key vulnerability in the SSLVPN of FortiOS may allow an attacker to retrieve the key by reverse engineering. This issue is related to the use of a hard-coded cryptographic key in the SSL-VPN portal of FortiOS, which can be exploited by a remote attacker to obtain the encryption key.

Recommendations For FortiOS versions prior to 7.0.1, update to version 7.0.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the SSLVPN portal until a patch is applied. Avoid using the SSLVPN portal for sensitive operations until the issue is resolved.