{"id":"CVE-2019-5591","published":"2020-08-14T16:15:16Z","modified":"2026-08-15T04:17:41Z","title":"Fortinet FortiOS Default Configuration Vulnerability","vendor":"Fortinet","product":"FortiOS","tier":"core","eol":null,"description":{"text":"A Default Configuration vulnerability in FortiOS may allow an unauthenticated attacker on the same subnet to intercept sensitive information by impersonating the LDAP server.","provenance":"source","from":"NVD"},"summary":{"text":"A default configuration flaw in Fortinet's FortiOS allows the device's LDAP-related functionality to be exploited, exposing it to attackers on the same subnet. An unauthenticated attacker on the same subnet, requiring no user interaction, can intercept sensitive information by impersonating the LDAP server.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T08:31:11Z"},"cvss":{"score":6.5,"severity":"MEDIUM","version":"3.1","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","provenance":"source","from":"NVD"},"epss":{"score":0.18566,"percentile":0.97243,"date":"2026-10-28","provenance":"source"},"kev":{"dateAdded":"2021-11-03","dueDate":"2022-05-03","ransomware":true,"requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2019-5591","provenance":"source"},"vulncheckKev":{"dateAdded":"2021-04-02","exploitedFirstSeen":"2021-04-02","ransomware":true,"evidence":[{"url":"https://www.ic3.gov/media/news/2021/210402.pdf","date":"2021-04-02"},{"url":"https://www.ic3.gov/media/news/2021/210527.pdf","date":"2021-05-27"},{"url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa21-209a","date":"2021-08-20"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2021-11-03"},{"url":"https://us-cert.cisa.gov/ncas/alerts/aa21-321a","date":"2021-11-17"},{"url":"https://cisa.gov/news-events/cybersecurity-advisories/aa21-321a","date":"2021-11-19"},{"url":"https://www.paloaltonetworks.com/content/dam/pan/en_US/assets/pdf/reports/2022-unit42-ransomware-threat-report-final.pdf","date":"2022-03-24"},{"url":"https://static.tenable.com/marketing/whitepapers/Whitepaper-Ransomware_Ecosystem.pdf","date":"2022-06-22"},{"url":"https://cisa.gov/news-events/cybersecurity-advisories/aa22-257a","date":"2022-09-14"},{"url":"https://www.cisa.gov/uscert/ncas/alerts/aa22-257a","date":"2022-09-14"}],"evidenceTotal":15,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"},{"name":"Actively_Exploited_Kev | Oct 18, 2026","url":"https://otx.alienvault.com/pulse/6ad38c22e1848f8189d1c121","created":"2026-10-17"}],"provenance":"machine"},"cwes":[{"id":"CWE-306","name":"Missing Authentication for Critical Functionality"}],"references":[{"url":"https://www.fortiguard.com/psirt/FG-IR-19-037","tags":["Mitigation","Vendor Advisory"]},{"url":"https://www.fortiguard.com/psirt/FG-IR-19-037","tags":["Mitigation","Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-5591","tags":["US Government Resource"]}],"techniques":[{"id":"T1133","name":"External Remote Services","tactics":["initial-access","persistence"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Default Configuration","mappingType":"exploitation_technique","evidence":[],"comment":"CVE-2019-5591 is a default configuration vulnerability in Fortinet's FortiOS, specifically affecting the FortiGate SSL VPN. This vulnerability allows an unauthenticated attacker on the same subnet to intercept sensitive information by impersonating a Lightweight Directory Access Protocol (LDAP) server.","confidence":"high"},{"id":"T1557","name":"Adversary-in-the-Middle","tactics":["collection","credential-access"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Default Configuration","mappingType":"primary_impact","evidence":[],"comment":"CVE-2019-5591 is a default configuration vulnerability in Fortinet's FortiOS, specifically affecting the FortiGate SSL VPN. This vulnerability allows an unauthenticated attacker on the same subnet to intercept sensitive information by impersonating a Lightweight Directory Access Protocol (LDAP) server.","confidence":"high"},{"id":"T1005","name":"Data from Local System","tactics":["collection"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Default Configuration","mappingType":"secondary_impact","evidence":[],"comment":"CVE-2019-5591 is a default configuration vulnerability in Fortinet's FortiOS, specifically affecting the FortiGate SSL VPN. This vulnerability allows an unauthenticated attacker on the same subnet to intercept sensitive information by impersonating a Lightweight Directory Access Protocol (LDAP) server.","confidence":"high"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2019-15166","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-15166","exploited":true,"exploitedSince":"2021-11-03","provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":1,"skipped":0,"earliest":"2025-10-16","earliestUrl":"https://github.com/ayewo/fortios-ldap-mitm-poc-CVE-2019-5591","repos":[{"name":"ayewo/fortios-ldap-mitm-poc-CVE-2019-5591","url":"https://github.com/ayewo/fortios-ldap-mitm-poc-CVE-2019-5591","stars":1,"created":"2025-10-16"}]},"nuclei":[{"id":"CVE-2019-5591","name":"FortiOS - Insecure LDAP Configuration Detection","severity":"medium","path":"http/cves/2019/CVE-2019-5591.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-5591.yaml"}],"first":{"date":"2025-10-16","source":"PoC-in-GitHub","url":"https://github.com/ayewo/fortios-ldap-mitm-poc-CVE-2019-5591"},"provenance":"source"},"exploitRefs":[],"flow":[{"stage":"exploitation","techniques":["T1133"],"provenance":"source"},{"stage":"primary","techniques":["T1557"],"provenance":"source"},{"stage":"secondary","techniques":["T1005"],"provenance":"source"}],"timeline":[{"date":"2020-08-14","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2019-5591","provenance":"source"},{"date":"2021-04-02","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.ic3.gov/media/news/2021/210402.pdf","provenance":"source"},{"date":"2021-11-03","kind":"kev","label":"Added to CISA KEV (known ransomware use)","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2021-11-03","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-15166","provenance":"source"},{"date":"2025-10-16","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub","url":"https://github.com/ayewo/fortios-ldap-mitm-poc-CVE-2019-5591","provenance":"source"}],"speed":{"daysToPublicExploit":1889,"firstExploitFrom":"PoC-in-GitHub","daysToKev":446},"priority":{"score":77.0,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 2036 days ago"},{"name":"Known ransomware use","points":10.0,"detail":"CISA KEV and VulnCheck KEV: Known"},{"name":"EPSS percentile","points":19.45,"detail":"percentile 0.9724"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 PoC-in-GitHub repo; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":4.55,"detail":"base score 6.5"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}