Unrated severityNVD Advisory· Published Mar 2, 2022· Updated Oct 22, 2024
CVE-2021-44166
CVE-2021-44166
Description
An improper access control vulnerability [CWE-284 ] in FortiToken Mobile (Android) external push notification 5.1.0 and below may allow a remote attacker having already obtained a user's password to access the protected system during the 2FA procedure, even though the deny button is clicked by the legitimate user.
Affected products
2- Range: <=5.1.0
- Range: FortiTokenAndroid 5.1.0 and below
Patches
Vulnerability mechanics
References
1- fortiguard.com/psirt/FG-IR-21-210mitrex_refsource_CONFIRM
News mentions
0No linked articles in our index yet.