Cryptographic Key Vulnerability in Fortinet's FortiSIEM

CVE-2019-17659

Summary

A vulnerability in FortiSIEM version 5.2.6 involves the use of a hard-coded cryptographic key, which can potentially allow a remote unauthenticated attacker to gain SSH access to the supervisor account under the user 'tunneluser'. This exploitation requires knowledge of the private key, which may be obtained from another installation or firmware image, posing a significant risk to system integrity and security.

References