Description (CNA)
Use of a hardcoded cryptographic key in the FortiGuard services communication protocol may allow a Man in the middle with knowledge of the key to eavesdrop on and modify information (URL/SPAM services in FortiOS 5.6, and URL/SPAM/AV services in FortiOS 6.0.; URL rating in FortiClient) sent and received from Fortiguard severs by decrypting these messages. Affected products include FortiClient for Windows 6.0.6 and below, FortiOS 6.0.7 and below, FortiClient for Mac OS 6.2.1 and below.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Fortinet / FortiClient for Windows | affected FortiClient for Windows 6.0.6 and below |
| Fortinet / FortiOS | affected FortiOS 6.0.7 and below |
| Fortinet / FortiClient for Mac OS | affected FortiClient for Mac OS 6.2.1 and below |
CWE
No CWE identifiers supplied.
References
ADP enrichment
No English description supplied.
No English description supplied.
No references supplied.