CVE-2018-13382

Unauthenticated attackers could modify passwords on Fortinet SSL VPN portals due to improper authorization vulnerabilities, actively exploited in the wild and linked to ransomware activity.

Fortinet FortiOS and FortiProxy devices suffered from a critical improper authorization flaw allowing password modification without authentication. This exposes DIB organizations using these devices to unauthorized access and potential data compromise, impacting CMMC/NIST 800-171 compliance (specifically access control). Immediate patching and access control review are essential.

Shame score — The vulnerability allowed unauthorized password modification, actively exploited and linked to ransomware, demonstrating a significant failure in access control and a lack of basic security practices.