Medium severity · published Nov 21, 2019
CVE-2018-9195
Use of a hardcoded cryptographic key in the FortiGuard services communication protocol may allow a Man in the middle with knowledge of the key to eavesdrop on and modify…
5.9
CVSS
1.6%
EPSS
No
On KEV
Description
Use of a hardcoded cryptographic key in the FortiGuard services communication protocol may allow a Man in the middle with knowledge of the key to eavesdrop on and modify information (URL/SPAM services in FortiOS 5.6, and URL/SPAM/AV services in FortiOS 6.0.; URL rating in FortiClient) sent and received from Fortiguard severs by decrypting these messages. Affected products include FortiClient for Windows 6.0.6 and below, FortiOS 6.0.7 and below, FortiClient for Mac OS 6.2.1 and below.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.6% · higher than 75% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FO
FortiOS · Fortinet
through 6.0.6 · source: NVD
FO
Forticlient · Fortinet
through 6.0.6; through 6.2.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2018-9195
CVE.org
https://www.cve.org/CVERecord?id=CVE-2018-9195
Third Party Advisory
https://fortiguard.com/advisory/FG-IR-18-100
More from FortiOS
9.8
CVE-2026-24858
Fortinet Multiple Products Authentication Bypass Using an Alternate Path or Channel Vulnerability
9.8
CVE-2025-25249
Fortinet Multiple Products Heap-based Buffer Overflow Vulnerability
9.8
CVE-2025-59718
Fortinet Multiple Products Improper Verification of Cryptographic Signature Vulnerability
9.8
CVE-2024-55591
Fortinet FortiOS and FortiProxy Authentication Bypass Vulnerability
9.8
CVE-2024-23113
Fortinet Multiple Products Format String Vulnerability