InfoSecBulletin Cybersecurity for mankind
Fortinet warns that a three-year-old vulnerability allows attackers to bypass 2FA on FortiGate firewalls by merely altering the capitalization of usernames.
The vulnerability FG-IR-19-283 (CVE-2020-12812) was reported and fixed in July 2020. Recently, it has been noted that attackers are exploiting this flaw in organizations that haven’t addressed specific configurations.
Daily Cyber security update for 25. 10. 2026
Daily Cyber security update for 24. 10. 2026
PHP shares new RCE flaw (CVE 2026-115560) with no patch but mitigation
US banks faced unauthorized access by AI agents in customer accounts: Axios reports
Atlassian patched 176 flaw in Jira and Confluence: Fortinet Urges to Patch Flaws Affecting FortiOS, FortiManager
Hacker claim to access Rajasthan Police data: 70,000 records allegedly exposed
Update now! PHP2Shell: Critical PHP vulnerabilities patched
Trump says data centres should pay dividends to local community
Hackers Actively Exploiting Palo Alto VPN Flaw Via CVE-2026-0257
DeepSeek AI banned by U.S. Government; federal agencies must remove all related tools
“Fortinet has observed recent abuse of the July 2020 vulnerability FG-IR-19-283/CVE-2020-12812 in the wild based on specific configurations,” the new analysis warns.
The flaw is a classic logic error born from a discrepancy between how different systems handle text. FortiGate firewalls traditionally treat usernames as case-sensitive (e.g., “User” is different from “user”), while many LDAP directories (like Microsoft Active Directory) treat them as the same.
“This particular authentication behavior is caused by FortiGate treating usernames as case-sensitive by default, when the LDAP Directory does not,” the report explains.
This mismatch creates a security loophole. An organization with a local user using 2FA and a backup LDAP policy allows attackers to bypass the security token.
The exploit is deceptively simple. Imagine a user named jsmith who is protected by a 2FA token.
An attacker tries to log in using VPN or the admin panel with different case variations, like JSmith or JSMITH.
The FortiGate checks its local user database and finds that JSmith is not the same as jsmith due to case sensitivity. As a result, it does not ask for the 2FA token.
The firewall checks secondary authentication methods like LDAP groups. It recognizes JSmith as a valid user because the LDAP server is case-insensitive and grants access based only on the password.
“If the user logs in with ‘Jsmith’, or ‘jSmith’, or ‘JSmith’, or ‘jsmith’ or anything that is NOT an exact case match to ‘jsmith’, the FortiGate will not match the login against the local user,” the report details. “Authentication will be successful regardless of any settings within the local user policy (2FA and disabled accounts)”.
The impact is severe: “This can result in admin or VPN users being authenticated without 2FA”.
Fortinet urges administrators to update their systems to versions 6.0.10, 6.2.4, 6.4.1, or newer.
Organizations that can’t upgrade right away or want to verify their setup can apply a manual fix. Admins can adjust the firewall to disregard case differences, closing the security gap.
“With username-sensitivity set to disabled, FortiGate will treat jsmith, JSmith, JSMITH and all possible combinations as identical and therefore prevent failover to any other misconfigured LDAP group setting,” the report advises.
Administrators should apply the following command to local accounts:
set username-sensitivity disable (for newer versions)
set username-case-sensitivity disable (for older versions)
The report suggests reviewing authentication policies: “Remove unnecessary secondary LDAP Groups” to reduce the attack surface.
