VYPR
← All advisories
Medium severity5.9NVD Advisory· Published Nov 21, 2019· Updated Jun 17, 2026

CVE-2018-9195

CVE-2018-9195

Description

Use of a hardcoded cryptographic key in the FortiGuard services communication protocol may allow a Man in the middle with knowledge of the key to eavesdrop on and modify information (URL/SPAM services in FortiOS 5.6, and URL/SPAM/AV services in FortiOS 6.0.; URL rating in FortiClient) sent and received from Fortiguard severs by decrypting these messages. Affected products include FortiClient for Windows 6.0.6 and below, FortiOS 6.0.7 and below, FortiClient for Mac OS 6.2.1 and below.

Affected products

8
  • Fortinet/Forticlient5 versions
    cpe:2.3:a:fortinet:forticlient:*:*:*:*:*:macos:*:*+ 4 more
    • cpe:2.3:a:fortinet:forticlient:*:*:*:*:*:macos:*:*range: <=6.2.1
    • cpe:2.3:a:fortinet:forticlient:*:*:*:*:*:windows:*:*range: <=6.0.6
    • (no CPE)range: <=6.0.6
    • (no CPE)range: FortiClient for Mac OS 6.2.1 and below
    • (no CPE)range: FortiClient for Windows 6.0.6 and below
  • Fortinet/Fortios3 versions
    cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*+ 2 more
    • cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*range: <=6.0.6
    • (no CPE)range: <=6.0.7
    • (no CPE)range: FortiOS 6.0.7 and below

Patches

Vulnerability mechanics

References

1

News mentions

0

No linked articles in our index yet.