PT-2020-7634 · Fortinet · Fortibalancer

Published 2020-03-19 · Updated 2020-03-23 · CVE-2014-2723

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions FortiBalancer versions 400, 1000, 2000, 3000

Description A platform-specific remote access issue has been discovered that may allow a remote user to gain privileged access to affected systems using SSH. The issue is caused by a configuration error and is not the result of an underlying SSH defect.

Recommendations For FortiBalancer versions 400, 1000, 2000, 3000, consider reconfiguring the system to prevent remote access via SSH until a proper fix is applied. As a temporary workaround, restrict SSH access to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Fix

Incorrect Default Permissions

Weakness Enumeration

CWE-276

Related Identifiers

CVE-2014-2723

Affected Products

Fortibalancer

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2014-2723 · Security Note
• https://fortiguard.com/advisory/FG-IR-14-010 · Vendor Advisory
• https://t.me/cibsecurity/10630 · Telegram Post