Main Vulnerability Database Vulnerabilities #VU64053

Improper validation of certificate with host mismatch in Fortinet, Inc products - CVE-2021-22131

Published: June 8, 2022

Vulnerability identifier: #VU64053

CSH Severity: Medium

CVSS v4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2021-22131

CWE-ID: CWE-297

Exploitation vector: Remote access

Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to perform MitM attack.

The vulnerability exists due to improper certificate validation. A remote attacker can spoof the validation server identity and perform MitM attack.

FortiToken Mobile for Android
FortiToken Mobile for Windows
FortiToken Mobile for iOS

Install updates from vendor's website.

FortiToken Mobile for Android - update to 5.1.0
FortiToken Mobile for Windows - update to 4.1.0
FortiToken Mobile for iOS - update to 5.3.0