Vulnerability Description
Use of a hardcoded cryptographic key in the FortiGuard services communication protocol may allow a Man in the middle with knowledge of the key to eavesdrop on and modify information (URL/SPAM services in FortiOS 5.6, and URL/SPAM/AV services in FortiOS 6.0.; URL rating in FortiClient) sent and received from Fortiguard severs by decrypting these messages. Affected products include FortiClient for Windows 6.0.6 and below, FortiOS 6.0.7 and below, FortiClient for Mac OS 6.2.1 and below.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Fortinet | Forticlient | <= 6.0.6 |
| Fortinet | Fortios | <= 6.0.6 |
Related Weaknesses (CWE)
References
- https://fortiguard.com/advisory/FG-IR-18-100Third Party Advisory
- https://fortiguard.com/advisory/FG-IR-18-100Third Party Advisory
FAQ
What is CVE-2018-9195?
CVE-2018-9195 is a vulnerability with a CVSS score of 5.9 (MEDIUM). Use of a hardcoded cryptographic key in the FortiGuard services communication protocol may allow a Man in the middle with knowledge of the key to eavesdrop on and modify information (URL/SPAM services...
How severe is CVE-2018-9195?
CVE-2018-9195 has been rated MEDIUM with a CVSS base score of 5.9/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2018-9195?
Check the references section above for vendor advisories and patch information. Affected products include: Fortinet Forticlient, Fortinet Fortios.