CVE-2020-12819

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2020-12819", "assignerOrgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", "state": "PUBLISHED", "assignerShortName": "fortinet", "dateReserved": "2020-05-12T00:00:00.000Z", "datePublished": "2024-12-19T07:40:58.144Z", "dateUpdated": "2024-12-20T17:41:24.593Z"}, "containers": {"cna": {"affected": [{"vendor": "Fortinet", "product": "FortiOS", "cpes": ["cpe:2.3:o:fortinet:fortios:6.4.1:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:6.4.0:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:6.2.4:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:6.2.3:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:6.2.2:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:6.2.1:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:6.2.0:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:6.0.10:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:6.0.9:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:6.0.8:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:6.0.7:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:6.0.6:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:6.0.5:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:6.0.4:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:6.0.3:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:6.0.2:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:6.0.1:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:6.0.0:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:5.6.12:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:5.6.11:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:5.6.10:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:5.6.9:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:5.6.8:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:5.6.7:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:5.6.6:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:5.6.5:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:5.6.4:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:5.6.3:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:5.6.2:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:5.6.1:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:5.6.0:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "versions": [{"versionType": "semver", "version": "6.4.0", "lessThanOrEqual": "6.4.1", "status": "affected"}, {"versionType": "semver", "version": "6.2.0", "lessThanOrEqual": "6.2.4", "status": "affected"}, {"versionType": "semver", "version": "6.0.0", "lessThanOrEqual": "6.0.10", "status": "affected"}, {"versionType": "semver", "version": "5.6.0", "lessThanOrEqual": "5.6.12", "status": "affected"}]}], "descriptions": [{"lang": "en", "value": "A heap-based buffer overflow vulnerability in the processing of Link Control Protocol messages in FortiGate versions 5.6.12, 6.0.10, 6.2.4 and 6.4.1 and earlier may allow a remote attacker with valid SSL VPN credentials to crash the SSL VPN daemon by sending a large LCP packet, when tunnel mode is enabled. Arbitrary code execution may be theoretically possible, albeit practically very difficult to achieve in this context"}], "providerMetadata": {"orgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", "shortName": "fortinet", "dateUpdated": "2024-12-19T07:40:58.144Z"}, "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-122", "description": "Execute unauthorized code or commands", "type": "CWE"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"version": "3.1", "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L/E:U/RL:X/RC:X"}}], "solutions": [{"lang": "en", "value": "Please upgrade to FortiOS versions 5.6.13 or above. \r\nPlease upgrade to FortiOS versions 6.0.11 or above. \r\nPlease upgrade to FortiOS versions 6.2.5 or above. \r\nPlease upgrade to FortiOS versions 6.4.2 or above.\r\nWorkaround: \r\nDisable tunnel mode."}], "references": [{"name": "https://fortiguard.com/advisory/FG-IR-20-082", "url": "https://fortiguard.com/advisory/FG-IR-20-082"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-12-20T16:45:10.916317Z", "id": "CVE-2020-12819", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-12-20T17:41:24.593Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2020-12819", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-12-20T16:45:10.916317Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-12-20T16:46:00.900Z"}}], "cna": {"metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L/E:U/RL:X/RC:X", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}}], "affected": [{"cpes": ["cpe:2.3:o:fortinet:fortios:6.4.1:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:6.4.0:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:6.2.4:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:6.2.3:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:6.2.2:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:6.2.1:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:6.2.0:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:6.0.10:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:6.0.9:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:6.0.8:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:6.0.7:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:6.0.6:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:6.0.5:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:6.0.4:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:6.0.3:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:6.0.2:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:6.0.1:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:6.0.0:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:5.6.12:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:5.6.11:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:5.6.10:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:5.6.9:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:5.6.8:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:5.6.7:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:5.6.6:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:5.6.5:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:5.6.4:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:5.6.3:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:5.6.2:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:5.6.1:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:5.6.0:*:*:*:*:*:*:*"], "vendor": "Fortinet", "product": "FortiOS", "versions": [{"status": "affected", "version": "6.4.0", "versionType": "semver", "lessThanOrEqual": "6.4.1"}, {"status": "affected", "version": "6.2.0", "versionType": "semver", "lessThanOrEqual": "6.2.4"}, {"status": "affected", "version": "6.0.0", "versionType": "semver", "lessThanOrEqual": "6.0.10"}, {"status": "affected", "version": "5.6.0", "versionType": "semver", "lessThanOrEqual": "5.6.12"}], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "Please upgrade to FortiOS versions 5.6.13 or above. \r\nPlease upgrade to FortiOS versions 6.0.11 or above. \r\nPlease upgrade to FortiOS versions 6.2.5 or above. \r\nPlease upgrade to FortiOS versions 6.4.2 or above.\r\nWorkaround: \r\nDisable tunnel mode."}], "references": [{"url": "https://fortiguard.com/advisory/FG-IR-20-082", "name": "https://fortiguard.com/advisory/FG-IR-20-082"}], "descriptions": [{"lang": "en", "value": "A heap-based buffer overflow vulnerability in the processing of Link Control Protocol messages in FortiGate versions 5.6.12, 6.0.10, 6.2.4 and 6.4.1 and earlier may allow a remote attacker with valid SSL VPN credentials to crash the SSL VPN daemon by sending a large LCP packet, when tunnel mode is enabled. Arbitrary code execution may be theoretically possible, albeit practically very difficult to achieve in this context"}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-122", "description": "Execute unauthorized code or commands"}]}], "providerMetadata": {"orgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", "shortName": "fortinet", "dateUpdated": "2024-12-19T07:40:58.144Z"}}}, "cveMetadata": {"cveId": "CVE-2020-12819", "state": "PUBLISHED", "dateUpdated": "2024-12-20T17:41:24.593Z", "dateReserved": "2020-05-12T00:00:00.000Z", "assignerOrgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", "datePublished": "2024-12-19T07:40:58.144Z", "assignerShortName": "fortinet"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:o:fortinet:fortios:6.4.1:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:6.4.0:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:6.2.4:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:6.2.3:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:6.2.2:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:6.2.1:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:6.2.0:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:6.0.10:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:6.0.9:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:6.0.8:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:6.0.7:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:6.0.6:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:6.0.5:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:6.0.4:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:6.0.3:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:6.0.2:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:6.0.1:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:6.0.0:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:5.6.12:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:5.6.11:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:5.6.10:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:5.6.9:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:5.6.8:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:5.6.7:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:5.6.6:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:5.6.5:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:5.6.4:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:5.6.3:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:5.6.2:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:5.6.1:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:5.6.0:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "product": "FortiOS", "vendor": "Fortinet", "versions": [{"lessThanOrEqual": "6.4.1", "status": "affected", "version": "6.4.0", "versionType": "semver"}, {"lessThanOrEqual": "6.2.4", "status": "affected", "version": "6.2.0", "versionType": "semver"}, {"lessThanOrEqual": "6.0.10", "status": "affected", "version": "6.0.0", "versionType": "semver"}, {"lessThanOrEqual": "5.6.12", "status": "affected", "version": "5.6.0", "versionType": "semver"}]}], "source": "psirt@fortinet.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*", "matchCriteriaId": "8C8DACBF-C9D5-4898-8294-DB887A28A9C7", "versionEndExcluding": "5.6.13", "vulnerable": true}, {"criteria": "cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*", "matchCriteriaId": "D44B5E8F-6093-4E84-9197-4530032E5B5A", "versionEndExcluding": "6.0.11", "versionStartIncluding": "6.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*", "matchCriteriaId": "B59A39D6-9494-4273-8348-1078A77DD796", "versionEndExcluding": "6.2.5", "versionStartIncluding": "6.2.0", "vulnerable": true}, {"criteria": "cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*", "matchCriteriaId": "FECE2DC5-CFCC-4BA9-B416-4EB2C1E4D9BB", "versionEndExcluding": "6.4.2", "versionStartIncluding": "6.4.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A heap-based buffer overflow vulnerability in the processing of Link Control Protocol messages in FortiGate versions 5.6.12, 6.0.10, 6.2.4 and 6.4.1 and earlier may allow a remote attacker with valid SSL VPN credentials to crash the SSL VPN daemon by sending a large LCP packet, when tunnel mode is enabled. Arbitrary code execution may be theoretically possible, albeit practically very difficult to achieve in this context"}, {"lang": "es", "value": "Una vulnerabilidad de desbordamiento de b\u00fafer en el mont\u00f3n durante el procesamiento de mensajes del Protocolo de control de enlaces en las versiones 5.6.12, 6.0.10, 6.2.4 y 6.4.1 y anteriores de FortiGate puede permitir que un atacante remoto con credenciales de VPN SSL v\u00e1lidas bloquee el daemon de VPN SSL mediante el env\u00edo de un paquete LCP de gran tama\u00f1o cuando el modo t\u00fanel est\u00e1 habilitado. La ejecuci\u00f3n de c\u00f3digo arbitrario puede ser te\u00f3ricamente posible, aunque en la pr\u00e1ctica es muy dif\u00edcil de lograr en este contexto"}], "id": "CVE-2020-12819", "lastModified": "2026-06-17T02:52:22.277", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.5, "source": "psirt@fortinet.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.6, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2020-12819", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2024-12-20T16:45:10.916317Z", "version": "2.0.3"}}]}, "published": "2024-12-19T08:15:11.770", "references": [{"source": "psirt@fortinet.com", "tags": ["Vendor Advisory"], "url": "https://fortiguard.com/advisory/FG-IR-20-082"}], "sourceIdentifier": "psirt@fortinet.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-122"}], "source": "psirt@fortinet.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-787"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{}