Fortinet FortiManager up to 6.2.3 CLI Backup File hard-coded credentials

Summaryinfo

A vulnerability classified as critical has been found in Fortinet FortiManager up to 6.2.3. Affected by this vulnerability is an unknown functionality of the component CLI. The manipulation as part of Backup File leads to hard-coded credentials. This vulnerability is uniquely identified as CVE-2020-9289. The attack is possible to be carried out remotely. No exploit exists.

Detailsinfo

A vulnerability, which was classified as critical, has been found in Fortinet FortiManager up to 6.2.3. This issue affects some unknown processing of the component CLI. The manipulation as part of a Backup File leads to a hard-coded credentials vulnerability. Using CWE to declare the problem leads to CWE-798. The product contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data. Impacted is confidentiality. The summary by CVE is:

Use of a hard-coded cryptographic key to encrypt password data in CLI configuration in FortiManager 6.2.3 and below may allow an attacker with access to the CLI configuration or the CLI backup file to decrypt the sensitive data, via knowledge of the hard-coded key.

The weakness was disclosed 06/16/2020 (Website). It is possible to read the advisory at fortiguard.com. The identification of this vulnerability is CVE-2020-9289 since 02/19/2020. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. The technical details are unknown and an exploit is not publicly available. The attack technique deployed by this issue is T1110.001 according to MITRE ATT&CK.

The vulnerability scanner Nessus provides a plugin with the ID 209820 (Fortinet Fortigate (FG-IR-19-007)), which helps to determine the existence of the flaw in a target environment.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at Tenable (209820). Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Vendor

• Fortinet

Name

• FortiManager

Version

• 6.2.0
• 6.2.1
• 6.2.2
• 6.2.3

License

• commercial

Website

• Vendor: https://www.fortinet.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion