Security readout for executives and security teams
Plain-English summary
Some Fortinet products used weak or incomplete cryptographic handling when storing LDAP and RADIUS credentials. If an attacker already obtains the password store, they may be able to recover encrypted secrets. This is not described as remotely exploitable by itself.
Executive priority
Treat as a credential confidentiality risk, not an internet-scale emergency. Prioritize systems that integrate with directory services or RADIUS and where administrative access controls are weak.
Technical view
CVE-2021-32591 affects FortiSandbox before 4.0.1, FortiWeb before 6.3.12, FortiADC before 6.2.1, and FortiMail 7.0.1 and earlier. The issue is missing cryptographic steps in credential encryption for LDAP and RADIUS secrets. CVSS 3.1 score is 5.3.
Likely exposure
Exposure is most relevant where affected Fortinet appliances are configured with LDAP or RADIUS credentials and an attacker can access the password store.
Exploitation context
The provided sources do not show CISA KEV listing or active exploitation. The CVSS vector requires low privileges and high attack complexity, with high confidentiality impact if the password store is obtained.
Researcher notes
Evidence is limited to the CVE record and Fortinet advisory reference. The key condition is attacker possession of the password store; sources do not provide exploit mechanics, public incidents, or detailed product-specific remediation for every listed product.
Mitigation direction
- Upgrade affected FortiSandbox, FortiWeb, and FortiADC systems beyond the named vulnerable versions.
- For FortiMail, check Fortinet advisory FG-IR-20-222 for the corrected release guidance.
- Rotate LDAP and RADIUS credentials after remediation if password store exposure is suspected.
- Restrict administrative and filesystem access to Fortinet appliance credential stores.
Validation and detection
- Inventory FortiSandbox, FortiWeb, FortiADC, and FortiMail versions in the environment.
- Identify systems using stored LDAP or RADIUS credentials.
- Review access logs for unauthorized administrative or file access to affected appliances.
- Confirm remediated versions align with Fortinet advisory FG-IR-20-222.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
Credential and access behavior lookup
The CVE wording references authentication or credential exposure, so valid-account and credential-access review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2021-32591 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5.3 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:X/RC:X
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:X/RC:X1.63.6Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
5.3MediumVector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:X/RC:X
Source materials
- CVE List V5 sourceCVE List V5
- https://fortiguard.com/advisory/FG-IR-20-222CVE reference · x_refsource_CONFIRM
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.