Vulnerability Description
The Endpoint Control protocol implementation in Fortinet FortiClient 5.2.3.091 for Android and 5.2.028 for iOS does not validate certificates, which makes it easier for man-in-the-middle attackers to spoof servers via a crafted certificate.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Fortinet | Forticlient | 5.2.3.091 |
Related Weaknesses (CWE)
References
- http://seclists.org/fulldisclosure/2015/Jan/124Exploit
- http://www.security-assessment.com/files/documents/advisory/Fortinet_FortiClientExploit
- http://seclists.org/fulldisclosure/2015/Jan/124Exploit
- http://www.security-assessment.com/files/documents/advisory/Fortinet_FortiClientExploit
FAQ
What is CVE-2015-1570?
CVE-2015-1570 is a vulnerability with a CVSS score of 4.3 (MEDIUM). The Endpoint Control protocol implementation in Fortinet FortiClient 5.2.3.091 for Android and 5.2.028 for iOS does not validate certificates, which makes it easier for man-in-the-middle attackers to ...
How severe is CVE-2015-1570?
CVE-2015-1570 has been rated MEDIUM with a CVSS base score of 4.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2015-1570?
Check the references section above for vendor advisories and patch information. Affected products include: Fortinet Forticlient.