CVE-2019-5591: Fortinet FortiOS Default Configuration Vulnerability

CVE-2019-5591 is a default configuration vulnerability in Fortinet FortiOS. It may allow an unauthenticated attacker on the same subnet to intercept sensitive information by impersonating the Lightweight Directory Access Protocol (LDAP) server. This matters because FortiOS commonly sits at network boundaries and authentication paths; a local attacker who can spoof LDAP can capture credentials or directory data that would otherwise stay protected.

The weakness is tracked as CWE-306 (missing authentication for a critical function). Public detail is limited to the CISA description; exact affected releases, CVSS scores, and exploit mechanics must be confirmed against the vendor advisory.

How it works

CWE-306 covers cases where a critical function proceeds without verifying the identity of the party requesting it. In this instance the default FortiOS configuration does not adequately authenticate the LDAP server that the device expects to talk to. An attacker who is already on the same Layer-2 subnet can present themselves as that LDAP server. Because the device does not challenge or validate the impersonator, directory queries and any credentials or attributes exchanged in those queries can be observed or altered by the attacker.

No remote unauthenticated exploitation from outside the subnet is described. The attack surface is therefore limited to hosts that share the local network segment with the FortiOS device and that can spoof or intercept LDAP traffic. Specific packet sequences or configuration knobs are not provided in the public summary; defenders should treat any default LDAP client settings on FortiOS as potentially trust-on-first-use or unauthenticated until verified against Fortinet’s advisory.

Am I affected? How to find it in your systems

FortiOS runs on Fortinet FortiGate firewalls and related appliances that frequently terminate VPN, perform user authentication, or proxy directory lookups. Inventory every FortiGate, FortiWifi, or other FortiOS-based device in your environment, including virtual instances and lab units.

• Record the exact FortiOS version and build from the GUI or CLI (for example, get system status).
• Identify whether LDAP or remote authentication servers are configured under User & Authentication or equivalent menus.
• Note the network segments on which those devices have interfaces; any subnet that can reach the LDAP client interface is in scope.
• Compare the running version and LDAP-related settings against the fixed releases listed in Fortinet’s advisory for CVE-2019-5591. If the advisory is unavailable, assume default configurations are suspect until proven otherwise.

Telemetry signs of exploitation are subtle because the attacker is impersonating a legitimate service. Look for unexpected LDAP server addresses or MAC addresses on the local segment, sudden changes in authentication success/failure rates, or duplicate LDAP responses. Packet captures on the FortiOS LDAP client interface can reveal unsolicited or spoofed LDAP traffic. No public indicators of compromise specific to this CVE are supplied; treat anomalous local LDAP behavior as worth investigating.

How to remediate

Apply the updates published by Fortinet for CVE-2019-5591. CISA’s required action is simply “Apply updates per vendor instructions.” Obtain the fixed FortiOS image from Fortinet’s support portal, verify its signature, and follow the vendor’s upgrade path for your hardware or VM model. After the upgrade, re-validate LDAP server entries and confirm that authentication to the real directory still succeeds.

Once patched, harden the LDAP client configuration: require LDAPS or StartTLS, pin the expected server certificate or public key, and restrict the LDAP client interface to a management or authentication VLAN that untrusted hosts cannot join. Remove any unused authentication server objects. These steps reduce the chance that a future default-configuration issue can be abused in the same way.

If you can't patch immediately

Until the vendor update can be installed, reduce exposure with compensating controls:

• Segment the FortiOS interfaces that perform LDAP queries onto a dedicated VLAN or VRF that only authorized directory servers and management hosts can reach; block all other devices at Layer 2 or 3.
• If the device supports it, disable LDAP authentication temporarily and fall back to a local or multi-factor method that does not rely on the vulnerable default path.
• Deploy monitoring or a network IDS rule that alerts on unexpected LDAP server advertisements or duplicate LDAP traffic on the local segment.
• Virtual patching via an external firewall or WAF is of limited use because the attack is local and protocol-level; focus instead on isolating the subnet.

Document the temporary controls and schedule the permanent patch as soon as operational windows allow.

If your data may have been exposed

Actively exploited vulnerabilities can lead to credential or directory-data exposure even when ransomware use is not documented for this CVE. If you discover evidence that an attacker impersonated your LDAP server, treat any credentials or attributes that traversed that path as potentially compromised: reset affected passwords, review authentication logs for anomalous logins, and check privileged accounts first. You can also run a free exposure scan of your email addresses against known breach data sets to see whether those identities have appeared in prior incidents.