CVSS: 5.9EPSS: 0%CPEs: 9EXPL: 0CVE-2016-8492
https://notcve.org/view.php?id=CVE-2016-8492
The implementation of an ANSI X9.31 RNG in Fortinet FortiGate allows attackers to gain unauthorized read access to data handled by the device via IPSec/TLS decryption. La implementación de un ANSI X9.31 RNG en Fortinet FortiGate permite a atacantes obtener acceso de lectura no autorizada a los datos manejados por el dispositivo a través de descifrado IPSec/TLS. • http://www.securityfocus.com/bid/94480 https://fortiguard.com/advisory/FG-IR-16-067 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 10.0EPSS: 96%CPEs: 4EXPL: 2CVE-2016-6909 – Fortigate Firewalls - 'EGREGIOUSBLUNDER' Remote Code Execution
https://notcve.org/view.php?id=CVE-2016-6909
Buffer overflow in the Cookie parser in Fortinet FortiOS 4.x before 4.1.11, 4.2.x before 4.2.13, and 4.3.x before 4.3.9 and FortiSwitch before 3.4.3 allows remote attackers to execute arbitrary code via a crafted HTTP request, aka EGREGIOUSBLUNDER. Desbordamiento de búfer en el analizador Cookie en Fortinet FortiOS 4.x en versiones anteriores a 4.1.11, 4.2.x en versiones anteriores a 4.2.13 y 4.3.x en versiones anteriores a 4.3.9 y FortiSwitch en versiones anteriores a 3.4.3 permite a atacantes remotos ejecutar código arbitrario a través de una petición HTTP manipulada, también conocido como EGREGIOUSBLUNDER. • https://www.exploit-db.com/exploits/40276 http://fortiguard.com/advisory/FG-IR-16-023 http://packetstormsecurity.com/files/138387/EGREGIOUSBLUNDER-Fortigate-Remote-Code-Execution.html http://www.securityfocus.com/bid/92523 http://www.securitytracker.com/id/1036643 https://musalbas.com/2016/08/16/equation-group-firewall-operations-catalogue.html • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 6.1EPSS: 0%CPEs: 17EXPL: 0CVE-2016-3978
https://notcve.org/view.php?id=CVE-2016-3978
The Web User Interface (WebUI) in FortiOS 5.0.x before 5.0.13, 5.2.x before 5.2.3, and 5.4.x before 5.4.0 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks or cross-site scripting (XSS) attacks via the "redirect" parameter to "login." La Web User Interface (WebUI) en FortiOS 5.0.x en versiones anteriores a 5.0.13, 5.2.x en versiones anteriores a 5.2.3 y 5.4.x en versiones anteriores a 5.4.0 permite a atacantes remotos redirigir a usuarios a sitios web arbitrarios y llevar a cabo ataques de phishing o ataques de XSS a través del parámetro "redirect" en "login". • http://seclists.org/fulldisclosure/2016/Mar/68 http://www.fortiguard.com/advisory/fortios-open-redirect-vulnerability http://www.securitytracker.com/id/1035332 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 10.0EPSS: 68%CPEs: 10EXPL: 4CVE-2016-1909 – Fortinet FortiGate 4.x < 5.0.7 - SSH Backdoor Access
https://notcve.org/view.php?id=CVE-2016-1909
Fortinet FortiAnalyzer before 5.0.12 and 5.2.x before 5.2.5; FortiSwitch 3.3.x before 3.3.3; FortiCache 3.0.x before 3.0.8; and FortiOS 4.1.x before 4.1.11, 4.2.x before 4.2.16, 4.3.x before 4.3.17 and 5.0.x before 5.0.8 have a hardcoded passphrase for the Fortimanager_Access account, which allows remote attackers to obtain administrative access via an SSH session. Fortinet FortiAnalyzer en versiones anteriores a 5.0.12 y 5.2.x en versiones anteriores a 5.2.5; FortiSwitch 3.3.x en versiones anteriores a 3.3.3; FortiCache 3.0.x en versiones anteriores a 3.0.8; y FortiOS 4.1.x en versiones anteriores a 4.1.11, 4.2.x en versiones anteriores a 4.2.16, 4.3.x en versiones anteriores a 4.3.17 y 5.0.x en versiones anteriores a 5.0.8 tienen una frase de contraseña embebida para la cuenta Fortimanager_Access, lo que permite a atacantes remotos obtener acceso administrativo a través de una sesión SSH. • https://www.exploit-db.com/exploits/43386 http://blog.fortinet.com/post/brief-statement-regarding-issues-found-with-fortios http://packetstormsecurity.com/files/135225/FortiGate-OS-5.0.7-SSH-Backdoor.html http://seclists.org/fulldisclosure/2016/Jan/26 http://www.fortiguard.com/advisory/multiple-products-ssh-undocumented-login-vulnerability http://www.securitytracker.com/id/1034663 https://twitter.com/esizkur/status/686842135501508608 https://www.exploit-db.com/exploits/39224 https://seclists.org/ • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 9.3EPSS: 0%CPEs: 1EXPL: 0CVE-2015-7361
https://notcve.org/view.php?id=CVE-2015-7361
FortiOS 5.2.3, when configured to use High Availability (HA) and the dedicated management interface is enabled, does not require authentication for access to the ZebOS shell on the HA dedicated management interface, which allows remote attackers to obtain shell access via unspecified vectors. FortiOS 5.2.3, cuando se configura para usar High Availability (HA) y la interfaz de administración dedicada está habilitada, no requiere autenticación para el acceso a la shell ZebOS en la interfaz de gestión dedicada HA, lo que permite a atacantes remotos obtener acceso a la shell a través de vectores no especificados. • http://fortiguard.com/advisory/zebos-routing-remote-shell-service-enabled http://www.fortiguard.com/advisory/zebos-routing-remote-shell-service-enabled http://www.securitytracker.com/id/1033093 • CWE-287: Improper Authentication •