Vulnerability · Published Jun 16, 2020 · Assigned by fortinet

CVE-2020-9289

High 7.5

In plain English

A high-severity security flaw in Fortinet FortiManager. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.2% (higher than 82% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.

Severity (CVSS NVD)7.5High

Exploit odds (30 days)2.2%top 17.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack tooling1Public PoC

Official description

Use of a hard-coded cryptographic key to encrypt password data in CLI configuration in FortiManager 6.2.3 and below, FortiAnalyzer 6.2.3 and below may allow an attacker with access to the CLI configuration or the CLI backup file to decrypt the sensitive data, via knowledge of the hard-coded key.

Affected products (as reported)

Vendor	Product	Versions
n/a	Fortinet FortiManager	FortiManager 6.2.3 and below

References

https://fortiguard.com/psirt/FG-IR-19-007 x_refsource_MISC