Fortinet warns of 5-year-old FortiOS 2FA bypass still exploited in attacks

Fortinet warns that CVE-2020-12812, an improper authentication flaw in FortiGate SSL VPNs, is being actively exploited to bypass FortiToken two-factor authentication by changing username case; patches and mitigation guidance were released in July 2020. Recent activity includes attacks against LDAP-configured appliances, involvement of state-backed actors and ransomware misuse, and advisories from FBI/CISA with CISA adding the CVE to its known exploited vulnerabilities catalog.