Improper access control in FortiToken Mobile for Android - CVE-2021-44166
Published: March 2, 2022
Vulnerability identifier: #VU60941
CSH Severity: Low
CVSS v4: 2.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2021-44166
CWE-ID: CWE-284
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to gain unauthorized access to otherwise restricted functionality.
The vulnerability exists due to improper access restrictions in external push notification. A remote user can access the protected system during the 2FA procedure, even though the deny button is clicked by the legitimate user.
Affected software
FortiToken Mobile for Android
How to mitigate CVE-2021-44166
Install updates from vendor's website.
FortiToken Mobile for Android - update to 5.2.0