PT-2015-3369 · Fortinet · Fortios

Denis Andzakovic · Published 2015-02-10 · Updated 2024-08-06 · CVE-2015-1571

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions FortiOS version 5.0 Patch 7 build 4457

Description The CAPWAP DTLS protocol implementation in FortiOS uses the same certificate and private key across different customers' installations. However, according to FG-IR-15-002, the Fortinet Factory certificate is unique to each device, which contradicts the initial statement. This discrepancy suggests confusion regarding the uniqueness of the certificate. If the certificate is indeed not unique, it could make it easier for man-in-the-middle attackers to spoof SSL servers by leveraging the Fortinet Factory certificate and private key.

Recommendations For FortiOS version 5.0 Patch 7 build 4457, consider disabling the use of the Fortinet Factory certificate and private key until a patch or clarification is available. However, given the contradiction in information, it's essential to consult official Fortinet resources for accurate guidance on mitigating potential risks associated with the CAPWAP DTLS protocol implementation. At the moment, there is no clear information about a newer version that contains a fix for this issue.

Exploit

Fix

Weakness Enumeration

CWE-310

Related Identifiers

BDU:2018-01298

CVE-2015-1571

Affected Products

Fortios

References · 6

• 🔥 http://seclists.org/fulldisclosure/2015/Jan/125 · Exploit
• 🔥 http://security-assessment.com/files/documents/advisory/Fortinet_FortiOS_Multiple_Vulnerabilities.pdf · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2015-1571 · Security Note
• https://bdu.fstec.ru/vul/2018-01298 · Security Note
• http://fortiguard.com/advisory/FG-IR-15-002 · Vendor Advisory
• https://t.me/cvenotify/89347 · Telegram Post