PT-2020-5573 · Fortinet · Forticlient

Published 2020-06-01 · Updated 2020-06-09 · CVE-2019-16150

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions FortiClient for Windows versions prior to 6.4.0

Description The issue is related to the use of a hard-coded cryptographic key in FortiClient for Windows, which may allow an attacker with access to local storage or configuration backup files to decrypt sensitive data. This could potentially give an attacker unauthorized access to protected information.

Recommendations For versions prior to 6.4.0, update to version 6.4.0 or later to resolve the issue. As a temporary workaround, consider restricting access to local storage and configuration backup files to minimize the risk of exploitation.

Fix

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

Related Identifiers

BDU:2021-01186

CVE-2019-16150

Affected Products

Forticlient

References · 5

• https://fortiguard.com/psirt/FG-IR-19-194 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-16150 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-16150 · Security Note
• https://bdu.fstec.ru/vul/2021-01186 · Security Note
• https://t.me/cvenotify/4193 · Telegram Post