CVE-2021-24005: fortinet fortiauthenticator Use of Hard-coded Credentials
CVSS: 7.5v3.1HighModified
Published 06-07-2021Last modified 25-10-2024
Vulnerability summary
CVE-2021-24005 is a high (CVSS 7.5) Use of Hard-coded Credentials vulnerability in fortinet fortiauthenticator. EPSS estimates a 0.56% chance of exploitation in the next 30 days, higher than 45.7% of scored vulnerabilities.
CVSS score
7.5/10
010
High · v3.1 (NVD)EPSS score
0.56%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Timeline
- 06-07-2021PublishedVulnerability first disclosed.
- 25-10-2024Last modifiedVulnerability information updated.
Description
Usage of hard-coded cryptographic keys to encrypt configuration files and debug logs in FortiAuthenticator versions before 6.3.0 may allow an attacker with access to the files or the CLI configuration to decrypt the sensitive data, via knowledge of the hard-coded key.
CVSS metrics
3 scores · 2 sources · 2 versionsHigh 7.5Preferred score · NVD (NIST)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NSources2 sources · 4.0–7.5
- CVE.orgCNA4.0MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:NDiffers
Medium 5.0Preferred score · NVD (NIST)
AV:N/AC:L/Au:N/C:P/I:N/A:NSourcesSingle source
EPSS trend
Probability
0.56%
Chance of exploitation in the next 30 days
Percentile
46%
Versus all other CVEs
30-day change
0.00 pp
From 0.56% on 19-09-2026
19-09-202619-10-2026
EPSS score0.56%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Fortinet1 product
- fortiauthenticatorFortiAuthenticator versions before 6.3.0. | ≥ 6.0.0, < 6.3.0
1 vendor · 1 product