CVE-2020-12819

State: Published
Severity: 5.4 Medium
Published: Dec 19, 2024
Updated: Dec 20, 2024
Reserved: May 12, 2020

Description

A heap-based buffer overflow vulnerability in the processing of Link Control Protocol messages in FortiGate versions 5.6.12, 6.0.10, 6.2.4 and 6.4.1 and earlier may allow a remote attacker with valid SSL VPN credentials to crash the SSL VPN daemon by sending a large LCP packet, when tunnel mode is enabled. Arbitrary code execution may be theoretically possible, albeit practically very difficult to achieve in this context

Scores

CVSS	Score	Vector	Source
3.1	5.4 Medium	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L/E:U/RL:X/RC:X	fortinet

Weaknesses

CWE-122 Execute unauthorized code or commands

Affected Products

Product	Versions
FortiOSFortinet	6.4.0 through 6.4.1Affected 6.2.0 through 6.2.4Affected 6.0.0 through 6.0.10Affected 5.6.0 through 5.6.12Affected

References

https://fortiguard.com/advisory/FG-IR-20-082

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.