CVE-2021-24005

Name of the Vulnerable Software and Affected Versions FortiAuthenticator versions prior to 6.3.0

Description The issue is related to the use of hard-coded cryptographic keys in FortiAuthenticator, which can allow an attacker with access to certain files or the CLI configuration to decrypt sensitive data. This is possible because the system uses predetermined cryptographic keys to encrypt configuration files and debug logs.

Recommendations For versions prior to 6.3.0, update to version 6.3.0 or later to resolve the issue. As a temporary workaround, consider restricting access to configuration files and the CLI configuration to minimize the risk of exploitation. Avoid using the hard-coded cryptographic keys in the affected configuration files and debug logs until the issue is resolved.