CVE-2016-1909: fortinet fortios
Vulnerability summary
CVE-2016-1909 is a high (CVSS 10.0) vulnerability in fortinet fortios. EPSS estimates a 71.27% chance of exploitation in the next 30 days, higher than 99.4% of scored vulnerabilities. 5 public exploits are recorded.
Timeline
- 15-01-2016PublishedVulnerability first disclosed.
- 05-08-2024Last modifiedVulnerability information updated.
Description
Fortinet FortiAnalyzer before 5.0.12 and 5.2.x before 5.2.5; FortiSwitch 3.3.x before 3.3.3; FortiCache 3.0.x before 3.0.8; and FortiOS 4.1.x before 4.1.11, 4.2.x before 4.2.16, 4.3.x before 4.3.17 and 5.0.x before 5.0.8 have a hardcoded passphrase for the Fortimanager_Access account, which allows remote attackers to obtain administrative access via an SSH session.
CVSS metrics
2 scores · 1 source · 2 versionsEPSS trend
Probability
71.27%
Chance of exploitation in the next 30 days
Percentile
99%
Versus all other CVEs
30-day change
0.00 pp
From 71.27% on 22-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
5 foundExploitDB 39224
Maturity: poc
Exploit Reference (seclists.org)
Maturity: unknown
Exploit Reference (packetstormsecurity.com)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Fortinet1 product
- fortios≤ 4.3.16 | 5.0 | 5.0.0 | 5.0.1 | 5.0.2 | 5.0.3 | 5.0.4 | 5.0.5 | 5.0.6 | 5.0.7
1 vendor · 1 product
References
7 links- blog.fortinet.com/post/brief-statement-regarding-issues-found-with-fortiosX Refsource CONFIRM
- twitter.com/esizkur/status/686842135501508608X Refsource MISC