CVE-2018-9195
CVE-2018-9195
Vexday Risk Score
3Low
SSVC decision (CISA)
Track
No exploitation signal → monitor
CVSS —EPSS 1.8%KEV nãoPoC —Nuclei —Metasploit —Patch —
Lifecycle
21 Nov 2019Published on NVD
Recommendation: Monitor — no exploitation signal at the moment.
Use of a hardcoded cryptographic key in the FortiGuard services communication protocol may allow a Man in the middle with knowledge of the key to eavesdrop on and modify information (URL/SPAM services in FortiOS 5.6, and URL/SPAM/AV services in FortiOS 6.0.; URL rating in FortiClient) sent and received from Fortiguard severs by decrypting these messages. Affected products include FortiClient for Windows 6.0.6 and below, FortiOS 6.0.7 and below, FortiClient for Mac OS 6.2.1 and below.
Affected products
Fortinet · FortiClient for Mac OSFortinet · FortiClient for WindowsFortinet · FortiOSWant to know if your infrastructure is exposed to this?
Talk to TrueHacking →