LiveActive security incident?Get immediate response
CVE Record

CVE-2020-15936: A improper input validation in Fortinet FortiGate version 6.4.3 and below, version 6.2.5 and below, version...

A improper input validation in Fortinet FortiGate version 6.4.3 and below, version 6.2.5 and below, version 6.0.11 and below, version 5.6.13 and below allows attacker to disclose sensitive information via SNI Client Hello TLS packets.

LowCVSS 2.6Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysislow

Security readout for executives and security teams

Plain-English summary

This Fortinet FortiOS issue is a low-severity input-validation flaw involving TLS SNI Client Hello packets. The public record says affected FortiGate/FortiOS versions could expose sensitive information, but the CVSS rating indicates difficult exploitation and limited impact.

Executive priority

Low immediate urgency, but do not ignore it on perimeter security infrastructure. Fold remediation into firewall maintenance, with faster action for exposed, unsupported, or high-value network segments.

Technical view

CVE-2020-15936 affects FortiOS 6.4.3 and below, 6.2.5 and below, 6.0.11 and below, and 5.6.13 and below. The CVSS vector is adjacent network, high complexity, high privileges, no user interaction, changed scope, and low integrity impact.

Likely exposure

Exposure is most likely where Fortinet FortiGate devices still run the listed FortiOS branches and versions. The CVSS vector limits practical risk to attackers with adjacent-network access and high privileges.

Exploitation context

The source bundle does not show CISA KEV listing or cited active exploitation. No exploit status is established here, so treat this as a hygiene and version-management issue unless vendor or monitoring evidence says otherwise.

Researcher notes

There is a notable source tension: the description says sensitive information disclosure, while CVSS lists confidentiality as none and integrity as low. Validate exact impact and fixed releases from Fortinet before scoring internal risk.

Mitigation direction

  • Inventory FortiGate devices and record exact FortiOS versions.
  • Check Fortinet advisory FG-IR-20-091 for vendor remediation guidance.
  • Upgrade affected FortiOS versions according to Fortinet-supported paths.
  • Restrict administrative and adjacent-network access to FortiGate management surfaces.
  • Prioritize unsupported or internet-adjacent appliances for remediation review.

Validation and detection

  • Compare device FortiOS versions against the affected version list.
  • Review Fortinet advisory FG-IR-20-091 for fixed-version details.
  • Confirm no FortiGate remains on 6.4.3 or earlier affected branches.
  • Review logs for unusual TLS/SNI handling anomalies if available.
  • Document compensating controls for any device awaiting upgrade.
Prepared
Confidence
medium
Sources
3

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2020-15936 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Low
CVSS
2.6 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:C/C:N/I:L/A:N/E:X/RL:X/RC:X

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
0Timeline events
0ADP providers
2Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
2.6CVSS 3.1LowCVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:C/C:N/I:L/A:N/E:X/RL:X/RC:X11.4Primary CVE score

Vulnerability scoring details

Base CVSS 3.1 score

2.6Low
CVSS 3.1 vector shape for CVE-2020-15936Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:C/C:N/I:L/A:N/E:X/RL:X/RC:X

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
FortinetFortinet FortiOSFortiOS 6.4.3, 6.4.2, 6.4.1, 6.4.0, 6.2.5, 6.2.4, 6.2.3, 6.2.2, 6.2.1, 6.2.0, 6.0.11, 6.0.10, 6.0.9, 6.0.8, 6.0.7, 6.0.6, 6.0.5, 6.0.4, 6.0.3, 6.0.2, 6.0.1, 6.0.0, 5.6.13, 5.6.12, 5.6.11, 5.6.10, 5.6.9, 5.6.8, 5.6.7, 5.6.6, 5.6.5, 5.6.4, 5.6.3, 5.6.2, 5.6.1, 5.6.0Listed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.