FortiOS RADIUS two-factor flaw accepts an invalid token
A read-only authenticated user can reach the GUI when RADIUS returns Access-Challenge after a bad token; CVSS 5.9.
Stories per day · 30 days
Relatedfortinet2certificate-validation1fortimanager1fortios1fortisase1improper-authentication1two-factor1
6 stories, newest first · one card per story
Stories tagged #radius
Fortinet RADIUS certificate flaw lets MITM impersonate the server
A rogue RADIUS server can be impersonated against FortiSASE Sovereign, FortiManager and FortiAnalyzer products, scored CVSS 7.5.
Protocol Integration of Physical Layer Deception into EAP-TEAP Wi-Fi Authentication
Researchers integrate physical-layer deception into EAP-TEAP Wi-Fi authentication in hostap 2.12.
Cisco Identity Services Engine RADIUS Denial of Service Vulnerability
Cisco patched a RADIUS flaw in Identity Services Engine letting unauthenticated remote attackers trigger denial of service on ISE nodes.
3BB Attacker Used MeshCentral Backdoor for Root Access, Targeted Subscriber Credentials
Hunt.io found an attacker holding root access inside Thai ISP 3BB via a MeshCentral backdoor, targeting subscriber RADIUS credential databases.
Broken access control in the RADIUS type admin group
FortiWeb RADIUS admin authentication flaw (CVSS 8.8) permits remote GUI/CLI login with random credentials under specific non-default settings.