CVE-2021-32591: fortinet fortiadc
Vulnerability summary
CVE-2021-32591 is a medium (CVSS 5.3) vulnerability in fortinet fortiadc. EPSS estimates a 0.93% chance of exploitation in the next 30 days, higher than 60% of scored vulnerabilities.
Timeline
- 08-12-2021PublishedVulnerability first disclosed.
- 25-10-2024Last modifiedVulnerability information updated.
Description
A missing cryptographic steps vulnerability in the function that encrypts users' LDAP and RADIUS credentials in FortiSandbox before 4.0.1, FortiWeb before 6.3.12, FortiADC before 6.2.1, FortiMail 7.0.1 and earlier may allow an attacker in possession of the password store to compromise the confidentiality of the encrypted secrets.
CVSS metrics
3 scores · 2 sources · 2 versions- NVDNIST5.3MediumCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
EPSS trend
Probability
0.93%
Chance of exploitation in the next 30 days
Percentile
60%
Versus all other CVEs
30-day change
+0.03 pp
From 0.90% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeNo weakness data has been published for this record.
Affected systems
Fortinet5 products
- fortiadc≥ 5.0.0, ≤ 5.4.4 | ≥ 6.0.0, ≤ 6.0.3 | ≥ 6.1.0, ≤ 6.1.3 | 6.2.0 | 6.2.1
- fortimail≥ 5.0, ≤ 5.6.3 | ≥ 6.0.0, ≤ 6.0.11 | ≥ 6.2.0, ≤ 6.2.7 | ≥ 6.4.0, ≤ 6.4.5 | 7.0.0 | 7.0.1
- fortinet fortisandboxFortiSandbox before 4.0.1, FortiWeb before 6.3.12, FortiADC before 6.2.1, FortiMail 7.0.1 and earlier
- fortisandbox≥ 3.2.0, ≤ 3.2.2 | 4.0.0
- fortiweb≥ 5.7.0, ≤ 5.7.3 | ≥ 5.8.0, ≤ 5.8.7 | ≥ 6.0.0, ≤ 6.0.7 | ≥ 6.1.0, ≤ 6.1.2 | ≥ 6.2.0, ≤ 6.2.4 | ≥ 6.3.0, ≤ 6.3.11 | 5.9.0 | 5.9.1
1 vendor · 5 products