NVD

Id
23844  
Name
CVE-2015-1571  
Description
** DISPUTED ** The CAPWAP DTLS protocol implementation in Fortinet FortiOS 5.0 Patch 7 build 4457 uses the same certificate and private key across different customers" installations, which makes it easier for man-in-the-middle attackers to spoof SSL servers by leveraging the Fortinet_Factory certificate and private key. NOTE: FG-IR-15-002 says "The Fortinet_Factory certificate is unique to each device ... An attacker cannot therefore stage a MitM attack."  
Reject
 
CVSS Version
2  
CVSS Score
4.3  
Severity
Medium  
CVSS Base Score
4.3  
CVSS Impact Subscore
2.9  
CVSS Exploit Subscore
8.6  
CVSS Vector
(AV:N/AC:M/Au:N/C:N/I:P/A:N)  
Pub Date
2017-01-19  
Published
2015-02-10  
Modified Date
2015-07-22  
Seq
2015-1571  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
126650 23844 CVE-2015-1571 20150129 Fortinet FortiOS Multiple Vulnerabilities  View
126651 23844 CVE-2015-1571 http://www.fortiguard.com/advisory/FG-IR-15-002/  View
126652 23844 CVE-2015-1571 http://www.security-assessment.com/files/documents/advisory/Fortinet_FortiOS_Multiple_Vulnerabilities.pdf  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
6155 JVNDB-2015-001475 Fortinet FortiOS の CAPWAP DTLS プロトコルの実装における SSL サーバになりすまされる脆弱性 Fortinet FortiOS の CAPWAP DTLS プロトコルの実装は、異なるカスタマのインストールに同じ証明書および秘密鍵を使用するため、SSL サーバになりすまされる脆弱性が存在します。 CVE-2015-1571 78796 CVE-2015-1571 23844 4.3 http://jvndb.jvn.jp/ja/contents/2015/JVNDB-2015-001475.html 2015-01-29 2015-02-17 View