InfoSecBulletin Cybersecurity for mankind
Fortinet warns that a three-year-old vulnerability allows attackers to bypass 2FA on FortiGate firewalls by merely altering the capitalization of usernames.
The vulnerability FG-IR-19-283 (CVE-2020-12812) was reported and fixed in July 2020. Recently, it has been noted that attackers are exploiting this flaw in organizations that haven’t addressed specific configurations.
Hackers deploy Casbaneiro Trojan that activates on bank websites
German police read Signal, Telegram, WhatsApp messages without breaking encryption
Urgent Patch! cPanel, GitLab Flaws Expose Users to RCE, File and Credential Theft
Palo Alto PAN-OS Flaw Enables Root Arbitrary Code Execution
Critical Check Point VPN flaws allow remote code execution attacks
Cisco confirms CVE-2026-20079 flaw in Secure FMC is exploited in attacks
Hackers exploit PaperCut flaws using hundreds of AI agents, compromising 440 servers globally
CISA Says Chinese Firms Extracted Billions of Tokens From Frontier AI Models
Nightmare Eclipse Drops New Microsoft Defender ‘ShieldCrash’ zero-day
cPanel Flaw Lets Hosting Accounts With Mail Privileges Execute Code as Root
“Fortinet has observed recent abuse of the July 2020 vulnerability FG-IR-19-283/CVE-2020-12812 in the wild based on specific configurations,” the new analysis warns.
The flaw is a classic logic error born from a discrepancy between how different systems handle text. FortiGate firewalls traditionally treat usernames as case-sensitive (e.g., “User” is different from “user”), while many LDAP directories (like Microsoft Active Directory) treat them as the same.
“This particular authentication behavior is caused by FortiGate treating usernames as case-sensitive by default, when the LDAP Directory does not,” the report explains.
This mismatch creates a security loophole. An organization with a local user using 2FA and a backup LDAP policy allows attackers to bypass the security token.
The exploit is deceptively simple. Imagine a user named jsmith who is protected by a 2FA token.
An attacker tries to log in using VPN or the admin panel with different case variations, like JSmith or JSMITH.
The FortiGate checks its local user database and finds that JSmith is not the same as jsmith due to case sensitivity. As a result, it does not ask for the 2FA token.
The firewall checks secondary authentication methods like LDAP groups. It recognizes JSmith as a valid user because the LDAP server is case-insensitive and grants access based only on the password.
“If the user logs in with ‘Jsmith’, or ‘jSmith’, or ‘JSmith’, or ‘jsmith’ or anything that is NOT an exact case match to ‘jsmith’, the FortiGate will not match the login against the local user,” the report details. “Authentication will be successful regardless of any settings within the local user policy (2FA and disabled accounts)”.
The impact is severe: “This can result in admin or VPN users being authenticated without 2FA”.
Fortinet urges administrators to update their systems to versions 6.0.10, 6.2.4, 6.4.1, or newer.
Organizations that can’t upgrade right away or want to verify their setup can apply a manual fix. Admins can adjust the firewall to disregard case differences, closing the security gap.
“With username-sensitivity set to disabled, FortiGate will treat jsmith, JSmith, JSMITH and all possible combinations as identical and therefore prevent failover to any other misconfigured LDAP group setting,” the report advises.
Administrators should apply the following command to local accounts:
set username-sensitivity disable (for newer versions)
set username-case-sensitivity disable (for older versions)
The report suggests reviewing authentication policies: “Remove unnecessary secondary LDAP Groups” to reduce the attack surface.
