CVE-2020-6648 : Security Advisory and Response

A cleartext storage of sensitive information vulnerability in FortiOS command line interface in versions 6.2.4 and earlier and FortiProxy 2.0.0, 1.2.9 and earlier may allow an authenticated attacker to obtain sensitive information such as users' passwords.

Understanding CVE-2020-6648

This CVE involves a vulnerability in FortiOS and FortiProxy versions that could lead to the disclosure of sensitive information.

What is CVE-2020-6648?

The vulnerability allows an authenticated attacker to access sensitive data like user passwords by executing a specific command in the FortiOS CLI.

The Impact of CVE-2020-6648

Base Score: 5.3 (Medium Severity)
Attack Vector: Network
Confidentiality Impact: Low
Integrity Impact: None
Privileges Required: None
Scope: Unchanged
User Interaction: None
Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Technical Details of CVE-2020-6648

This section provides more in-depth technical information about the vulnerability.

Vulnerability Description

The vulnerability involves cleartext storage of sensitive information in FortiOS CLI, allowing attackers to retrieve user passwords.

Affected Systems and Versions

Products: FortiGate and FortiProxy
Versions: FortiOS versions 6.2.4 and earlier, FortiProxy 2.0.0, 1.2.9, and earlier

Exploitation Mechanism

Attackers can exploit this vulnerability by connecting to FortiGate CLI and executing the "diag sys ha checksum show" command.

Mitigation and Prevention

Protecting systems from this vulnerability requires immediate actions and long-term security practices.

Immediate Steps to Take

Update FortiOS and FortiProxy to the latest versions
Monitor network traffic for any suspicious activities
Change passwords for affected accounts

Long-Term Security Practices

Regularly review and update security configurations
Conduct security training for users and administrators

Patching and Updates

Apply security patches provided by Fortinet