CVE-2018-13382

Exploited in the wild. In CISA KEV since 2022‑01‑10. A vendor fix is available.

CVSS 3.19.1Critical EPSS percentile99th82% chance in 30 days CISA KEVListedsince 2022-01-10, due 2022-07-10
No public exploit known FixVendor fixNo build named by the sources

Published 2019-06-04Updated 2025-10-24Sources: CVE.org, NVD, BDU

NVD CVE.org

What to do

The vendor has published a fix. Version details are below where the sources state them.

Steps

Written by AI from the record

Check whether you run FortiOS or FortiProxy in the affected version ranges, and confirm the SSL VPN web portal is enabled.
If you are affected, upgrade immediately to the fixed versions: FortiProxy 1.2.9 or FortiOS 5.4.11.
After upgrading, review authentication and SSL VPN logs for suspicious password-change activity and unusual login attempts.
If you cannot upgrade right away, disable or restrict access to the SSL VPN web portal (especially from the public internet) until updates are applied.

Vendor advisory Usually a quick update

Check it yourselfA free Nuclei and OpenVAS check exists for this CVE. Run it against your hosts.Is your organisation exposed?Discuss checks for your systems with a specialist. Scope is agreed before testing.

What it is

From the CVE record

An Improper Authorization vulnerability in Fortinet FortiOS 6.0.0 to 6.0.4, 5.6.0 to 5.6.8 and 5.4.1 to 5.4.10 and FortiProxy 2.0.0, 1.2.0 to 1.2.8, 1.1.0 to 1.1.6, 1.0.0 to 1.0.7 under SSL VPN web portal allows an unauthenticated attacker to modify the password of an SSL VPN web portal user via specially crafted HTTP requests

In plain language

Written by AI from the record

CVE-2018-13382 lets an outsider who can reach your Fortinet SSL VPN web portal change any VPN user’s password without logging in—typical small businesses should treat this as urgent to fix if you’re running the affected FortiOS/FortiProxy versions.

Fortinet FortiOS and FortiProxy have an improper authorization flaw (CWE-863) in the SSL VPN web portal that allows an unauthenticated attacker on the network to change arbitrary SSL VPN users’ passwords via specially crafted web requests.

If you're affected

SSL VPN account takeover
Unauthorized access to company apps
Potential ransomware entry point
Incident response and downtime

What is it

This vulnerability is like having a “password change” door on your VPN that doesn’t actually require someone to be logged in. If an attacker can reach that VPN web page, they can force a password reset for any VPN account, which can let them get into your business network or systems without permission.

Who is affected

This matters if you run Fortinet FortiOS or FortiProxy and provide SSL VPN access through the SSL VPN web portal to your users. In real attacks, criminals have used this weakness as an entry point.

You’re at risk when your device is on a vulnerable version and the SSL VPN web portal is reachable (for example, exposed to the network/internet).

How urgent is it

This is RED because attackers have real-world exploited it, and CISA lists it as being used in ransomware campaigns. There’s no need for a victim login—attackers can change passwords remotely—so exposure can quickly turn into account takeover.

Act immediately to move to the fixed versions.

What to do — in detail

Confirm whether we’re affected
- Identify the exact installed versions of Fortinet FortiOS and/or FortiProxy.
- Verify whether the SSL VPN web portal is enabled on the device.
- Confirm whether the SSL VPN web portal is reachable from the network beyond trusted admin locations (especially from the public internet).
Remediate (target fixed versions)
- FortiProxy: upgrade to 1.2.9.
- FortiOS: upgrade to 5.4.11.
- Use Fortinet’s vendor instructions from the referenced advisories when planning the upgrade.
If you are currently exposed and cannot upgrade immediately
- Reduce or block external access to the SSL VPN web portal until the device is patched (for example, restrict it to trusted IPs or disable public reachability).
- Monitor for suspicious password-change behavior during the interim.
Validate after patching
- Check SSL VPN/user authentication logs for password-change events that don’t match legitimate admin actions.
- Look for unusual login attempts after any suspicious password-change timestamps.
Ongoing monitoring
- Continue watching logs for account changes tied to the SSL VPN web portal and alert on unexpected password resets.

Technical context

Severity and exposure: Rated CRITICAL with a network attack vector and no required authentication or user interaction in the findings. The weakness is CWE-863 (Improper Authorization), specifically allowing unauthorized modification of SSL VPN user credentials.

Mechanism: An unauthenticated remote attacker can send crafted HTTP requests to the SSL VPN web portal to change the password of arbitrary SSL VPN users.

Exploitation status: This vulnerability is listed in the CISA KEV program and was added with a remediation due date of 2022-07-10, with CISA indicating it has been used in ransomware campaigns.

Patch status: Fixed releases are provided per product: FortiProxy fixed in 1.2.9 and FortiOS fixed in 5.4.11.

Exploit maturity: Weaponization is indicated in the findings as detection-template only (no additional exploit details), but KEV confirms real-world use, which is why this is treated as actively dangerous.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS99th

CISA KEV

Listed as exploited in the wild since 2022-01-10.

US federal agencies must remediate by 2022-07-10.

Known use in ransomware campaigns.

Apply updates per vendor instructions.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

82% chance of exploitation activity in the next 30 days, which ranks it in the 99th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

8 events over 2578 days, from the signal feeds we watch.

2026-06-25OpenVAS check added
2026-03-06Nuclei check added
2025-10-24Patch availablerecord updated
2022-01-10Added to CISA KEVransomware campaign
2019-06-04Publishedweakness classified, att&ck mapped

Affected products

Fortinetcommercial · USaka forti net
Fortinet Inc.commercial · USaka fortinet
- FortiOSSecurity Products

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Scored 9.1 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability NoneNo availability impact