Fortinet FortiClient Vulnerability in Android Applications
CVE-2015-1453

Currently unrated

Key Information:

Vendor

Fortinet
Status
Forticlient
Vendor
CVE Published:
2 February 2015

What is CVE-2015-1453?

The qm class in Fortinet FortiClient version 5.2.3.091 for Android contains a hardcoded encryption key, 'FoRtInEt!AnDrOiD'. This weakness allows potential attackers to obtain user passwords and other sensitive information by directly leveraging the key to decrypt data stored in Shared Preferences. As a result, users' sensitive data may be at risk, highlighting the importance of secure key management practices in mobile applications.

References

http://www.security-assessment.com/files/documents/adviso...
x_refsource_MISC
http://seclists.org/fulldisclosure/2015/Jan/124
mailing-listx_refsource_FULLDISC
http://www.securityfocus.com/bid/72383
vdb-entryx_refsource_BID

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.