7.5high
CVE-2017-17543
Users' VPN authentication credentials are unsafely encrypted in Fortinet FortiClient for Windows 5.6.0 and below versions, FortiClient for…
Published 8 y ago · modified 4 mo ago · JSON
CVSS
7.5
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
0.4%
percentile 38%
Public exploits
0
none known
Summary
Users' VPN authentication credentials are unsafely encrypted in Fortinet FortiClient for Windows 5.6.0 and below versions, FortiClient for Mac OSX 5.6.0 and below versions and FortiClient SSLVPN Client for Linux 4.4.2335 and below versions, due to the use of a static encryption key and weak encryption algorithms.
CISA SSVC assessment
- Exploitation
- none
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 2 y ago
Exploit prediction (EPSS)
0.44% probability of exploitation in the next 30 days, higher than 38% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 3.0 | 7.5 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| NVD | 2.0 | 5.0 | AV:N/AC:L/Au:N/C:P/I:N/A:N |
Affected products
- Fortinet, Inc. FortiClient for Windows
- Fortinet, Inc. FortiClient for Mac OSX
- Fortinet, Inc. FortiClient SSLVPN Client for Linux
Classification
- Weakness
- CWE-326 Inadequate Encryption Strength
- Technology feeds
- Fortinet (RSS, critical only)
References
- fortiguard.com /advisory/FG-IR-17-214 · x_refsource_CONFIRM, x_transferred
Sources
- CVE List: CVE-2017-17543
- NVD: CVE-2017-17543
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.