Skip to content
CVE PROGRAM SOURCE RECORD4.1 Medium

CVE-2021-44166

An improper access control vulnerability [CWE-284 ] in FortiToken Mobile (Android) external push notification 5.1.0 and below may allow a remote attacker having already obtained a

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
fortinet

Description

An improper access control vulnerability [CWE-284 ] in FortiToken Mobile (Android) external push notification 5.1.0 and below may allow a remote attacker having already obtained a user's password to access the protected system during the 2FA procedure, even though the deny button is clicked by the legitimate user.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Fortinet Fortinet FortiTokenAndroid

  • FortiTokenAndroid 5.1.0 and belowaffected

References