Coverage › CVE-2020-12812

CVE-2020-12812 Mapped Sigma

Fortinet FortiOS SSL VPN Improper Authentication Vulnerability

Vendor / product

Fortinet — FortiOS

Description (CISA)

Fortinet FortiOS SSL VPN contains an improper authentication vulnerability that may allow a user to login successfully without being prompted for the second factor of authentication (FortiToken) if they change the case in their username.

Added to KEV

2021-11-03

Due date

2022-05-03

Required action

Apply updates per vendor instructions.

Known ransomware use

Known

CWE

CWE-178, CWE-287

CISA notes

https://nvd.nist.gov/vuln/detail/CVE-2020-12812

Elsewhere

cve.org · NVD · CISA KEV · JSON

ATT&CK techniques · CTID Mappings Explorer, ATT&CK 16.1, KEV snapshot 2025-07-28

2 mapping objects across 1 technique. exploitation technique states how the vulnerability is exploited; primary and secondary impact state what exploitation achieves. They are different claims and are labelled as such.

Detection chain · ATT&CK Enterprise v19.2 detection strategies, analytics, log sources

T1556 Modify Authentication Process exploitation technique, primary impact

• DET0104 Detect Modification of Authentication Processes Across Platforms
  AN0287 Windows

  Detects modification of LSASS and authentication DLLs, suspicious registry changes to password filter packages, and abnormal process access to lsass.exe. Correlates registry modifications, DLL loads, and process handle access events.

  WinEventLog:Security EventCode=4657 → DC0063 Windows Registry Key Modification

  WinEventLog:Sysmon EventCode=10 → DC0035 Process Access

  WinEventLog:Sysmon EventCode=7 → DC0016 Module Load

  Tunable: MonitoredRegistryKeys TimeWindow
  AN0288 Linux

  Detects modification of PAM configuration files, unauthorized new PAM modules, and suspicious process execution accessing PAM-related binaries. Correlates file modification events in /etc/pam.d/ with process execution of unauthorized binaries.

  auditd:SYSCALL open, write → DC0061 File Modification

  auditd:SYSCALL execve → DC0032 Process Creation

  Tunable: WatchedPaths
  AN0289 macOS

  Detects unauthorized additions or changes to /Library/Security/SecurityAgentPlugins and suspicious process activity attempting to hook authentication APIs. Correlates file modifications with abnormal plugin loads in authentication flows.

  macos:unifiedlog SecurityAgentPlugins modification → DC0061 File Modification

  macos:osquery process_open → DC0035 Process Access

  Tunable: PluginPaths
  AN0290 Identity Provider

  Detects suspicious configuration changes in IdP authentication flows such as enabling reversible password encryption, MFA bypass, or policy weakening. Correlates policy modification events with unusual administrative activity.

  azure:policy UpdatePolicy → DC0069 Cloud Service Modification

  m365:unified Set-ADUser OR Set-ADAccountControl → DC0010 User Account Modification

  Tunable: PolicyBaseline
  AN0291 IaaS

  Detects unauthorized changes to IAM authentication configurations such as disabling MFA, creating backdoor access keys, or altering trust policies. Correlates identity policy updates with unusual login behavior.

  AWS:CloudTrail UpdateLoginProfile → DC0010 User Account Modification

  AWS:CloudTrail UpdateAccountPasswordPolicy → DC0069 Cloud Service Modification

  Tunable: ApprovedAccounts

Sigma rules tagged attack.t1556 (12)