An improper access control vulnerability CWE-284 in FortiAuthenticator HA service 6.3.2 and below 6.2.x 6.1.x 6.0.x may allow an attacker on the same vlan as the HA management interface to make an unauthenticated direct connection to the FAC's database.