CVE-2021-41028

8.2HIGH

Key Information:

Vendor
Fortinet
Status
Fortinet Forticlientems, Forticlientwindows, Forticlientlinux, Forticlientmac
Vendor
CVE Published:
16 December 2021

Summary

A combination of a use of hard-coded cryptographic key vulnerability [CWE-321] in FortiClientEMS 7.0.1 and below, 6.4.6 and below and an improper certificate validation vulnerability [CWE-297] in FortiClientWindows, FortiClientLinux and FortiClientMac 7.0.1 and below, 6.4.6 and below may allow an unauthenticated and network adjacent attacker to perform a man-in-the-middle attack between the EMS and the FCT via the telemetry protocol.

Affected Version(s)

Fortinet FortiClientEMS, FortiClientWindows, FortiClientLinux, FortiClientMac FortiClientEMS 7.0.1 and below, 6.4.6 and below, FortiClientWindows, FortiClientLinux, FortiClientMac 7.0.1 and below, 6.4.6 and below.

References

https://fortiguard.com/advisory/FG-IR-21-075
x_refsource_CONFIRM

CVSS V3.1

Score:
8.2
Severity:
HIGH
Confidentiality:
Low
Integrity:
High
Availability:
Low
Attack Vector:
Adjacent Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.