CVE-2016-8492

CVE-2016-8492 describes an information-disclosure vulnerability in Fortinet FortiGate/FortiOS where the ANSI X9.31 RNG is used in long‑lived security channels (IPSec/TLS), potentially allowing unauthorized read access to data. Connected sources confirm this relates to DUHK-style weaknesses in RNG...

CVE-2016-8492

The implementation of an ANSI X9.31 RNG in Fortinet FortiGate allows attackers to gain unauthorized read access to data handled by the device via IPSec/TLS decryption...

CVE-2016-8492

The implementation of an ANSI X9.31 RNG in Fortinet FortiGate allows attackers to gain unauthorized read access to data handled by the device via IPSec/TLS decryption...

Fortinet FortiOS 5.2.x < 5.2.10 / 5.4.1 < 5.4.2 Local Password Hash Disclosure (FG-IR-16-050)

The remote FortiGate device is running a version of FortiOS that is 5.2.x prior to 5.2.10, or else it is running version 5.4.1. It is, therefore, affected by a local information disclosure vulnerability due to a failure to properly protect password hashes stored on the device. A local attacker ca...

CVE-2016-8491

The presence of a hardcoded account named 'core' in Fortinet FortiWLC allows attackers to gain unauthorized read/write access via a remote shell...

Hardcoded credentials

The presence of a hardcoded account named 'core' in Fortinet FortiWLC allows attackers to gain unauthorized read/write access via a remote shell...

CVE-2016-8491

The presence of a hardcoded account named 'core' in Fortinet FortiWLC allows attackers to gain unauthorized read/write access via a remote shell...

CVE-2016-8491

CVE-2016-8491 affects Fortinet FortiWLC: presence of a hardcoded account named 'core' that allows attackers to gain unauthorized read/write access via a remote shell. This is evidenced across multiple sources (Fortinet advisory FG-IR-16-065 and various CVE/NVD records) describing a hardcoded core...

CVE-2016-8491

The presence of a hardcoded account named 'core' in Fortinet FortiWLC allows attackers to gain unauthorized read/write access via a remote shell...

Fortinet FortiGate ZebOS routing remote shell service enabled (FG-IR-15-020)

The Fortinet FortiGate device has the ZebOS routing remote shell service enabled. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only if descriptio...

CVE-2016-7054: the OpenSSl 1.1.0 a and 1.1.0 b heap overflow exploit-vulnerability warning-the black bar safety net

A few days ago, Fortinet has published a entitled“OpenSSL ChaCha20-Poly1305 heap overflowCVE-2016-7054analysis”article. The OpenSSL library in a high risk heap overflow vulnerability was discovered, affecting 1. 1. 0a and 1. 1. 0 b version. Vulnerability code is in...

Fortinet FortiOS Information Disclosure Vulnerability (CNVD-2016-12205)

Fortinet FortiOS is a set of security operating system developed by the U.S. Fiat Fortinet company dedicated to FortiGate network security platform. The system provides users with firewall, antivirus, IPSec/SSL VPN, Web content filtering and anti-spam and other security features. An information...

Fortinet FortiOS 5.x < 5.4.2 Flow-mode Detection Bypass

The remote FortiGate device is running a version of FortiOS that is 5.x prior to 5.4.2. It is, therefore, affected by a security bypass vulnerability when reloading the scanning engine after an update that results in active network sessions no longer being monitored by flow-mode detection. An...

Fortinet FortiOS 4.3.x < 4.3.19 TLS and IPSEC Information Disclosure

The remote FortiGate device is running a version of FortiOS that is 4.3.x prior to 4.2.19. It is, therefore, affected by a flaw due to the implementation the ANSI X9.31 RNG that is used to decrypt TLS and IPSec traffic. A man-in-the-middle MitM attacker can exploit this to disclose sensitive...

Fortinet FortiOS Security Bypass Vulnerability (CNVD-2016-11690)

Fortinet FortiOS is a set of security operating system developed by the U.S. Fiat Fortinet company dedicated to FortiGate network security platform. The system provides users with firewall, antivirus, IPSec/SSL VPN, Web content filtering and anti-spam and other security features. A security bypas...

Fortinet FortiOS Information Disclosure Vulnerability (CNVD-2016-11691)

Fortinet FortiOS is a set of security operating system developed by the U.S. Fiat Fortinet company dedicated to FortiGate network security platform. The system provides users with firewall, antivirus, IPSec/SSL VPN, Web content filtering and anti-spam and other security features. An information...

Fortinet FortiClient Unsupported Version Detection (macOS)

According to its self-reported version number, the installation of Fortinet FortiClient on the remote host is no longer supported. Lack of support implies that no new security patches for the product will be released by the vendor. As a result, it is likely to contain security vulnerabilities...

Fortinet FortiWLC Hard-Coded Security Bypass Vulnerability

Fortinet FortiWLC is a wireless controller from Fortinet. A security bypass vulnerability exists in the hardcoding of the Fortinet FortiWLC, which could be exploited by an attacker to gain access to the system and obtain sensitive information...

Fortinet FortiManager XSS Vulnerability (FG-IR-16-051)

Fortinet FortiManager is prone to a cross-site-scripting XSS vulnerability. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Fortinet FortiWLC Information Disclosure Vulnerability

Fortinet FortiWLC is a wireless controller from Fortinet. A security vulnerability exists in Fortinet FortiWLC. An attacker can exploit this vulnerability by reading the pam.log file to obtain sensitive user credentials...