CVE-2019-17659

A use of hard-coded cryptographic key vulnerability in FortiSIEM version 5.2.6 may allow a remote unauthenticated attacker to obtain SSH access to the supervisor as the restricted user "tunneluser" by leveraging knowledge of the private key from another installation or a firmware image...

The vulnerability of the FortiSIEM security management system, related to the use of strictly encrypted credentials, allows attackers to enhance their privileges.

The vulnerability of the FortiSIEM security management system is related to the use of strictly encrypted user credentials for the “tunneluser” user. Exploiting this vulnerability could allow a malicious actor to increase their privileges remotely...

Fortinet FortiSIEM 5.2.5 / 5.2.6 Hardcoded Key

Vendor: Fortinet Product: FortiSIEM Tested version: 5.2.5, 5.2.6. I haven't confirmed older versions, but there is a good chance they're also affected. CVE: Fortinet hands out their own CVEs according to Mitre, and since no human confirmation was received by Fortinet, no CVE was created yet. ==...