CVE-2020-12820

Published Dec 19, 2024 CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Description

Under non-default configuration, a stack-based buffer overflow in FortiOS version 6.0.10 and below, version 5.6.12 and below may allow a remote attacker authenticated to the SSL VPN to crash the FortiClient NAC daemon (fcnacd) and potentially execute arbitrary code via requesting a large FortiClient file name. We are not aware of proof of concept code successfully achieving the latter.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Fortinet

FortiOS

unaffected

Version	Status	Constraints
`6.0.0`	affected	≤ 6.0.10
`5.6.0`	affected	≤ 5.6.12

Configuration 1 [-]

OR	cpe:2.3:o:fortinet:fortios::::::::
	cpe:2.3:o:fortinet:fortios::::::::

No data.

No data available yet.

Remediation

Vendor Solution

Please upgrade to FortiOS versions 5.6.13 or above. Please upgrade to FortiOS versions 6.0.11 or above. FortiOS versions 6.2.0 and above are not impacted. FortiOS versions 6.4.0 and above are not impacted. Workaround: Please ensure that Fortiheartbeat and Endpoint-Compliance are not both enabled on the same interface. FortiHeartbeat and Endpoint-Compliance can be disabled on a particular interface by following the below CLI commands: config system interface edit interface set endpoint-compliance disable (<-- Disabled by default) set fortiheartbeat disable next end

Tracking

Advisories

Source	ID	Title
EUVD	EUVD-2020-5103	Under non-default configuration, a stack-based buffer overflow in FortiOS version 6.0.10 and below, version 5.6.12 and below may allow a remote attacker authenticated to the SSL VPN to crash the FortiClient NAC daemon (fcnacd) and potentially execute arbitrary code via requesting a large FortiClient file name. We are not aware of proof of concept code successfully achieving the latter.

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact Low

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.887% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://fortiguard.fortinet.com/psirt/FG-IR-20-083

History

Jul 15, 2025 1:45 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics	epss `{'score': 0.00297}`	epss `{'score': 0.00376}`

Jan 21, 2025 9:00 PM Weaknesses updated. Affected versions updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-787
CPEs		cpe:2.3:o:fortinet:fortios::::::::

Dec 20, 2024 6:15 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Dec 19, 2024 11:15 AM Description updated. First appearance in the feed. Weaknesses updated. Affected versions updated. Affected vendors updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Under non-default configuration, a stack-based buffer overflow in FortiOS version 6.0.10 and below, version 5.6.12 and below may allow a remote attacker authenticated to the SSL VPN to crash the FortiClient NAC daemon (fcnacd) and potentially execute arbitrary code via requesting a large FortiClient file name. We are not aware of proof of concept code successfully achieving the latter.
First Time appeared		Fortinet Fortinet fortios
Weaknesses		CWE-121
CPEs		cpe:2.3:o:fortinet:fortios:5.6.0:::::::* cpe:2.3:o:fortinet:fortios:5.6.10:::::::* cpe:2.3:o:fortinet:fortios:5.6.11:::::::* cpe:2.3:o:fortinet:fortios:5.6.12:::::::* cpe:2.3:o:fortinet:fortios:5.6.1:::::::* cpe:2.3:o:fortinet:fortios:5.6.2:::::::* cpe:2.3:o:fortinet:fortios:5.6.3:::::::* cpe:2.3:o:fortinet:fortios:5.6.4:::::::* cpe:2.3:o:fortinet:fortios:5.6.5:::::::* cpe:2.3:o:fortinet:fortios:5.6.6:::::::* cpe:2.3:o:fortinet:fortios:5.6.7:::::::* cpe:2.3:o:fortinet:fortios:5.6.8:::::::* cpe:2.3:o:fortinet:fortios:5.6.9:::::::* cpe:2.3:o:fortinet:fortios:6.0.0:::::::* cpe:2.3:o:fortinet:fortios:6.0.10:::::::* cpe:2.3:o:fortinet:fortios:6.0.1:::::::* cpe:2.3:o:fortinet:fortios:6.0.2:::::::* cpe:2.3:o:fortinet:fortios:6.0.3:::::::* cpe:2.3:o:fortinet:fortios:6.0.4:::::::* cpe:2.3:o:fortinet:fortios:6.0.5:::::::* cpe:2.3:o:fortinet:fortios:6.0.6:::::::* cpe:2.3:o:fortinet:fortios:6.0.7:::::::* cpe:2.3:o:fortinet:fortios:6.0.8:::::::* cpe:2.3:o:fortinet:fortios:6.0.9:::::::*
Vendors & Products		Fortinet Fortinet fortios
References		https://fortiguard.fortinet.com/psirt/FG-IR-20-083
Metrics		cvssV3_1 `{'score': 5.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L/E:U/RL:X/RC:X'}`