Improper Access Control in Fortinet FortiOS & FortiADC (CVE‑2018‑13374) Exposes LDAP Credentials
What It Is — Fortinet FortiOS and FortiADC contain an improper access‑control flaw that lets an unauthenticated attacker trick the appliance into sending a LDAP‑server connectivity test to a rogue LDAP server, thereby harvesting the LDAP service account credentials configured on the device.
Exploitability — The vulnerability is publicly disclosed (CVE‑2018‑13374) and has been assigned a CVSS v3.1 base score of 7.5 (High). No public exploit code is required; an attacker can trigger the behavior simply by issuing a crafted test request.
Affected Products — Fortinet FortiOS (all supported versions at the time of disclosure) and FortiADC appliances.
Why It Matters for Trust & Control Assurance
- Demonstrates the need for continuous verification that access‑control policies are enforced as intended, providing audit‑ready evidence for control‑objective compliance.
- Highlights the importance of monitoring LDAP integration points and capturing evidence of credential protection across the network stack.
- A breach of LDAP service accounts can cascade into broader domain compromise, making robust identity‑and‑access controls a critical trust signal for enterprise buyers.
Recommended Actions
- Apply Fortinet’s security patch for CVE‑2018‑13374 immediately.
- Review and harden LDAP connectivity test configurations; restrict test requests to trusted internal LDAP servers only.
- Enable logging of LDAP test traffic and integrate logs into a centralized SIEM for continuous monitoring.
- Validate that your identity‑access control framework captures evidence of proper credential handling and access‑control enforcement.
Source: CISA KEV – CVE‑2018‑13374