fortinet fortitoken-mobile CVE-2021-44166 is a vulnerability in Fortinet Fortitoken Mobile
Published on March 2, 2022

An improper access control vulnerability [CWE-284 ] in FortiToken Mobile (Android) external push notification 5.1.0 and below may allow a remote attacker having already obtained a user's password to access the protected system during the 2FA procedure, even though the deny button is clicked by the legitimate user.

NVD

Vulnerability Analysis

CVE-2021-44166 is exploitable with network access, requires user interaction and a small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality, with no impact on integrity, and no impact on availability.

Attack Vector:
NETWORK
Attack Complexity:
LOW
Privileges Required:
LOW
User Interaction:
REQUIRED
Scope:
CHANGED
Confidentiality Impact:
NONE
Integrity Impact:
LOW
Availability Impact:
NONE

Products Associated with CVE-2021-44166

Want to know whenever a new CVE is published for Fortinet Fortitoken Mobile? stack.watch will email you.

Fortinet Fortitoken Mobile
 

Affected Versions

Fortinet FortiTokenAndroid Version FortiTokenAndroid 5.1.0 and below is affected by CVE-2021-44166

Exploit Probability

EPSS
0.17%
Percentile
38.48%

EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.