Vulnerability Details : CVE-2015-1453
Potential exploit
The qm class in Fortinet FortiClient 5.2.3.091 for Android uses a hardcoded encryption key of FoRtInEt!AnDrOiD, which makes it easier for attackers to obtain passwords and possibly other sensitive data by leveraging the key to decrypt data in the Shared Preferences.
Products affected by CVE-2015-1453
- cpe:2.3:a:fortinet:forticlient:*:*:*:*:*:android:*:*
Exploit prediction scoring system (EPSS) score for CVE-2015-1453
0.16%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 34 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2015-1453
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
5.0
|
MEDIUM | AV:N/AC:L/Au:N/C:P/I:N/A:N |
10.0
|
2.9
|
NIST |
CWE ids for CVE-2015-1453
-
Assigned by: nvd@nist.gov (Primary)
References for CVE-2015-1453
-
http://seclists.org/fulldisclosure/2015/Jan/124
Full Disclosure: Fortinet FortiClient Multiple VulnerabilitiesExploit
-
http://www.security-assessment.com/files/documents/advisory/Fortinet_FortiClient_Multiple_Vulnerabilities.pdf
Exploit
-
http://www.securityfocus.com/bid/72383
Fortinet FortiOS Multiple Security Vulnerabilities
Jump to