CVE-2018-9195: fortinet forticlient Use of Hard-coded Credentials
Vulnerability summary
CVE-2018-9195 is a medium (CVSS 5.9) Use of Hard-coded Credentials vulnerability in fortinet forticlient. EPSS estimates a 1.58% chance of exploitation in the next 30 days, higher than 75.1% of scored vulnerabilities.
Timeline
- 21-11-2019PublishedVulnerability first disclosed.
- 25-10-2024Last modifiedVulnerability information updated.
Description
Use of a hardcoded cryptographic key in the FortiGuard services communication protocol may allow a Man in the middle with knowledge of the key to eavesdrop on and modify information (URL/SPAM services in FortiOS 5.6, and URL/SPAM/AV services in FortiOS 6.0.; URL rating in FortiClient) sent and received from Fortiguard severs by decrypting these messages. Affected products include FortiClient for Windows 6.0.6 and below, FortiOS 6.0.7 and below, FortiClient for Mac OS 6.2.1 and below.
CVSS metrics
2 scores · 1 source · 2 versionsEPSS trend
Probability
1.58%
Chance of exploitation in the next 30 days
Percentile
75%
Versus all other CVEs
30-day change
-0.23 pp
From 1.81% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Fortinet4 products
- forticlient≤ 6.0.6 | ≤ 6.2.1
- forticlient for mac osFortiClient for Mac OS 6.2.1 and below
- forticlient for windowsFortiClient for Windows 6.0.6 and below
- fortiosFortiOS 6.0.7 and below | ≤ 6.0.6
1 vendor · 4 products