CVE-2019-5591: Fortinet FortiOS Default Configuration Vulnerability Allows LDAP Impersonation
What It Is — Fortinet FortiOS ships with a default configuration that trusts any LDAP server on the local subnet. An unauthenticated attacker on the same network segment can spoof the LDAP service and capture credentials or other directory data.
Exploitability — No public exploit code is required; the flaw is exploitable by simply positioning a malicious host on the same subnet. CVSS v3.1 base score 7.5 (High).
Affected Products — FortiOS versions prior to the security patch released in March 2020 (all FortiGate appliances running those firmware releases).
Why It Matters for Trust & Control Assurance
- Demonstrates the need for secure configuration management – a single mis‑set default can undermine an entire security perimeter.
- Continuous control monitoring must capture configuration drift to provide defensible audit evidence for frameworks such as NIST CSF 2.0.
- Enterprises are increasingly asked to prove that baseline hardening controls are enforced; a default‑config flaw erodes that trust signal.
Recommended Actions
- Apply the FortiOS security update that disables the insecure default LDAP trust.
- Review and harden LDAP settings: enable TLS, restrict trusted servers to known IPs, and disable anonymous bind.
- Integrate configuration‑state checks into your continuous monitoring platform to flag any re‑introduction of the default.
- Document the remediation in your control evidence repository to support audit readiness.
Source: CISA KEV – CVE‑2019‑5591