PSIRT Advisories

FortiADC is vulnerable to retrieval of sensitive information in cleartext via GUI


A cleartext storage of sensitive information in GUI in FortiADC may allow a remote authenticated attacker to retrieve some sensitive information such as users LDAP passwords and RADIUS shared secret by deobfuscating the passwords entry fields.

Affected Products

FortiADC versions 6.0.0 and below. FortiADC versions 5.4.3 and below.


Please upgrade to FortiADC versions 6.0.1 or above. Please upgrade to FortiADC versions 5.4.4 or above.


Fortinet is pleased to thank Harish Chowdary for reporting this vulnerability under responsible disclosure.