CVE-2019-5591

Summary dbcve.org

FortiOS contains a default configuration vulnerability where the LDAP server authentication does not properly validate server certificates or uses insecure settings. An unauthenticated attacker on the same subnet can perform a man-in-the-middle attack to impersonate the LDAP server and intercept sensitive authentication credentials.

Mitigation

Change the default LDAP configuration to enforce LDAPS (LDAP over SSL/TLS) with certificate validation, or implement mutual TLS authentication to prevent LDAP server impersonation.