LiveActive security incident?Get immediate response
CVE Record

CVE-2021-41030: An authentication bypass by capture-replay vulnerability [CWE-294] in FortiClient EMS versions 7.0.1 and be...

An authentication bypass by capture-replay vulnerability [CWE-294] in FortiClient EMS versions 7.0.1 and below and 6.4.4 and below may allow an unauthenticated attacker to impersonate an existing user by intercepting and re-using valid SAML authentication messages.

MediumCVSS 5.4Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

FortiClient EMS had a SAML login weakness where an unauthenticated attacker could reuse intercepted valid authentication messages to impersonate an existing user. The listed impact is limited confidentiality and integrity loss, with no availability impact. Risk is meaningful for organizations using affected EMS versions and SAML authentication.

Executive priority

Treat this as a scheduled but important remediation item. It is not marked KEV in the bundle, but authentication bypass in endpoint management infrastructure can create business risk if exposed in a reachable administrative network.

Technical view

CVE-2021-41030 is a CWE-294 capture-replay authentication bypass in FortiClient EMS 7.0.1 and below, 6.4.4 and below, and listed 6.2.x releases. CVSS 3.1 is 5.4 with adjacent attack vector, low complexity, no privileges, and no user interaction.

Likely exposure

Exposure is likely limited to FortiClient EMS deployments running the affected 7.0.x, 6.4.x, or listed 6.2.x versions, especially where SAML authentication is enabled and an attacker could intercept valid SAML messages.

Exploitation context

The provided bundle does not show CISA KEV listing or cited active exploitation. The CVSS temporal vector includes exploit maturity F, but no public exploit details or campaign evidence are provided here.

Researcher notes

Evidence is strongest for affected versions, weakness class, and CVSS characteristics. The bundle does not provide fixed version numbers, exploitation reports, or detailed mitigations beyond the Fortinet advisory reference. Avoid assuming broader Fortinet product impact.

Mitigation direction

  • Review Fortinet advisory FG-IR-21-192 for official fixed versions and upgrade guidance.
  • Inventory FortiClient EMS versions across production, staging, and disaster recovery environments.
  • Prioritize remediation where EMS uses SAML authentication.
  • Restrict EMS access to trusted administrative networks while vendor remediation is assessed.

Validation and detection

  • Confirm FortiClient EMS version against the affected version list.
  • Determine whether SAML authentication is configured for EMS access.
  • Review authentication logs for unusual successful logins or reused sessions.
  • Verify remediation status against Fortinet advisory FG-IR-21-192.
Prepared
Confidence
high
Sources
3

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

description · low confidence lookup

Credential and access behavior lookup

The CVE wording references authentication or credential exposure, so valid-account and credential-access review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2021-41030 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Medium
CVSS
5.4 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N/E:F/RL:O/RC:C

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
0Timeline events
0ADP providers
2Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
5.4CVSS 3.1MediumCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N/E:F/RL:O/RC:C2.82.5Primary CVE score

Vulnerability scoring details

Base CVSS 3.1 score

5.4Medium
CVSS 3.1 vector shape for CVE-2021-41030Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N/E:F/RL:O/RC:C

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
FortinetFortinet FortiClientEMSFortiClientEMS 7.0.1, 7.0.0, 6.4.4, 6.4.3, 6.4.2, 6.4.1, 6.4.0, 6.2.9, 6.2.8, 6.2.7, 6.2.6, 6.2.4, 6.2.3, 6.2.2, 6.2.1, 6.2.0Listed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.