CVE Vulnerability

CVE-2019-16150

Use of a hard-coded cryptographic key to encrypt security sensitive data in local storage and configuration in FortiClient for Windows prior to 6.4.0 may allow an attacker with access to the local storage or the configuration backup file to decrypt the sensitive data via knowledge of the hard-coded key.

5 /10

CVSS v2.0 :

V3 Legend

Vector :

Exploitability : 10 / Impact : 2.9

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

Scope

5.5 /10

CVSS v3.0 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://fortiguard.com/psirt/FG-IR-19-194 Vendor Advisory
Configurations

Configuration 1

cpe:2.3:a:fortinet:forticlient:*:*:*:*:*:windows:*:*
Information

Published : 2020-06-04 01:15

Updated : 2020-06-09 05:56

NVD link : CVE-2019-16150

Mitre link : CVE-2019-16150

Products Affected
No products.
CWE
CWE-798