CVE-2015-1571 - The CAPWAP DTLS protocol implementation in Fortinet FortiOS 5.0 Patch 7 build 4457 uses the same certificate and private key across different customers' installations, which makes it easier for man-in-the-middle attackers to spoof SSL servers by leveraging the Fortinet_Factory certificate and private key

Back Back to CVE browser

MEDIUM

The CAPWAP DTLS protocol implementation in Fortinet FortiOS 5.0 Patch 7 build 4457 uses the same certificate and private key across different customers' installations, which makes it easier for man-in-the-middle attackers to spoof SSL servers by leveraging the Fortinet_Factory certificate and private key

Published Feb 10, 2015

4.3

MEDIUM

CVSS 2.0

EPSS 0.86%

Description

The CAPWAP DTLS protocol implementation in Fortinet FortiOS 5.0 Patch 7 build 4457 uses the same certificate and private key across different customers' installations, which makes it easier for man-in-the-middle attackers to spoof SSL servers by leveraging the Fortinet_Factory certificate and private key. NOTE: FG-IR-15-002 says "The Fortinet_Factory certificate is unique to each device ... An attacker cannot therefore stage a MitM attack.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-310

References (4)

http://seclists.org/fulldisclosure/2015/Jan/125
mailing-listx_refsource_FULLDISCExploit
http://www.fortiguard.com/advisory/FG-IR-15-002/
x_refsource_MISCVendor Advisory
http://www.security-assessment.com/files/documents/advisory/Fortinet_FortiOS_Multiple_Vulnerabilities.pdf
x_refsource_MISCExploit
https://euvd.enisa.europa.eu/vulnerability/EUVD-2015-1703
Advisory

Link	Providers	Tags
http://seclists.org/fulldisclosure/2015/Jan/125		mailing-listx_refsource_FULLDISCExploit
http://www.fortiguard.com/advisory/FG-IR-15-002/		x_refsource_MISCVendor Advisory
http://www.security-assessment.com/files/documents/advisory/Fortinet_FortiOS_Multiple_Vulnerabilities.pdf		x_refsource_MISCExploit
https://euvd.enisa.europa.eu/vulnerability/EUVD-2015-1703		Advisory