InfoSecBulletin Cybersecurity for mankind
Fortinet warns that a three-year-old vulnerability allows attackers to bypass 2FA on FortiGate firewalls by merely altering the capitalization of usernames.
The vulnerability FG-IR-19-283 (CVE-2020-12812) was reported and fixed in July 2020. Recently, it has been noted that attackers are exploiting this flaw in organizations that haven’t addressed specific configurations.
Brazilian health surveillance platform breach exposes 100K+ sensitive documents
Thousands of data centers are at risk of compromise due to a 22-year-old flaw
Bangladesh Launches (CIRS) and National ICT & Cyber Security Rating System (NRS)
CVE-2026-18574
Check Point Authentication Bypass Hits Management Server
TP-Link RCE and SonicWall Zero-Click Flaws Enable Complete Device Compromise
ExfilSquad releases info of over 100,000 UK police officers, staff
CISA alerts to cyberattacks affecting U.S. water utilities
“CyberStrike” AI-Driven Security Platform for Automated Testing
AIDCQ Propose to invest $2 billion in AI data center in Bangladesh
NVIDIA BlueField Flaw Enables Code Execution Attacks
“Fortinet has observed recent abuse of the July 2020 vulnerability FG-IR-19-283/CVE-2020-12812 in the wild based on specific configurations,” the new analysis warns.
The flaw is a classic logic error born from a discrepancy between how different systems handle text. FortiGate firewalls traditionally treat usernames as case-sensitive (e.g., “User” is different from “user”), while many LDAP directories (like Microsoft Active Directory) treat them as the same.
“This particular authentication behavior is caused by FortiGate treating usernames as case-sensitive by default, when the LDAP Directory does not,” the report explains.
This mismatch creates a security loophole. An organization with a local user using 2FA and a backup LDAP policy allows attackers to bypass the security token.
The exploit is deceptively simple. Imagine a user named jsmith who is protected by a 2FA token.
An attacker tries to log in using VPN or the admin panel with different case variations, like JSmith or JSMITH.
The FortiGate checks its local user database and finds that JSmith is not the same as jsmith due to case sensitivity. As a result, it does not ask for the 2FA token.
The firewall checks secondary authentication methods like LDAP groups. It recognizes JSmith as a valid user because the LDAP server is case-insensitive and grants access based only on the password.
“If the user logs in with ‘Jsmith’, or ‘jSmith’, or ‘JSmith’, or ‘jsmith’ or anything that is NOT an exact case match to ‘jsmith’, the FortiGate will not match the login against the local user,” the report details. “Authentication will be successful regardless of any settings within the local user policy (2FA and disabled accounts)”.
The impact is severe: “This can result in admin or VPN users being authenticated without 2FA”.
Fortinet urges administrators to update their systems to versions 6.0.10, 6.2.4, 6.4.1, or newer.
Organizations that can’t upgrade right away or want to verify their setup can apply a manual fix. Admins can adjust the firewall to disregard case differences, closing the security gap.
“With username-sensitivity set to disabled, FortiGate will treat jsmith, JSmith, JSMITH and all possible combinations as identical and therefore prevent failover to any other misconfigured LDAP group setting,” the report advises.
Administrators should apply the following command to local accounts:
set username-sensitivity disable (for newer versions)
set username-case-sensitivity disable (for older versions)
The report suggests reviewing authentication policies: “Remove unnecessary secondary LDAP Groups” to reduce the attack surface.
