CVE

Id
78848  
CVE No.
CVE-2015-1571  
Status
Candidate  
Description
** DISPUTED ** The CAPWAP DTLS protocol implementation in Fortinet FortiOS 5.0 Patch 7 build 4457 uses the same certificate and private key across different customers" installations, which makes it easier for man-in-the-middle attackers to spoof SSL servers by leveraging the Fortinet_Factory certificate and private key. NOTE: FG-IR-15-002 says "The Fortinet_Factory certificate is unique to each device ... An attacker cannot therefore stage a MitM attack."  
Phase
Assigned (20150210)  
Votes
None (candidate not yet proposed)  
Comments
 

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
718989 78848 CVE-2015-1571 FULLDISC:20150129 Fortinet FortiOS Multiple Vulnerabilities  View
718990 78848 CVE-2015-1571 URL:http://seclists.org/fulldisclosure/2015/Jan/125  View
718991 78848 CVE-2015-1571 MISC:http://www.fortiguard.com/advisory/FG-IR-15-002/  View

Related JVN

Id JVN No. Title Summary CVE No. CVE Id CVSS_v2 CVSS_v3 JVN URL Actions
6413 JVNDB-2015-001733 Microsoft Internet Explorer 11 における任意のコードを実行される脆弱性 Microsoft Internet Explorer 11 には、任意のコードを実行される、またはサービス運用妨害 (メモリ破損) 状態にされる脆弱性が存在します。 CVE-2015-1623 78848 9.3 http://jvndb.jvn.jp/ja/contents/2015/JVNDB-2015-001733.html  View