September 8, 2022 · Applied Cybernetics Group
CVE-2018-13374 — Fortinet FortiOS and FortiADC
known ransomware use
Fortinet FortiOS and FortiADC Improper Access Control Vulnerability
- Added to KEV
2022-09-08- Federal due date
2022-09-29- Vendor
- Fortinet
- Product
- FortiOS and FortiADC
- EPSS
- 98.5th percentile (score 0.378, as of
2026-09-16) - NVD CVSS v3.1
- 4.3 (MEDIUM)
- Ransomware use
- Known
- Upstream
- https://nvd.nist.gov/vuln/detail/CVE-2018-13374
CISA short description
Fortinet FortiOS and FortiADC contain an improper access control vulnerability that allows attackers to obtain the LDAP server login credentials configured in FortiGate by pointing a LDAP server connectivity test request to a rogue LDAP server.
Required action
Apply updates per vendor instructions.
NVD description
A Improper Access Control in Fortinet FortiOS 6.0.2, 5.6.7 and before, FortiADC 6.1.0, 6.0.0 to 6.0.1, 5.4.0 to 5.4.4 allows attacker to obtain the LDAP server login credentials configured in FortiGate via pointing a LDAP server connectivity test request to a rogue LDAP server instead of the configured one.