CVE-2012-4948
CVSS2
Attack Vector
ADJACENT_NETWORK
Attack Complexity
HIGH
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:A/AC:H/Au:N/C:C/I:P/A:N
AI Score
Confidence
Low
EPSS
Percentile
26.8%
The default configuration of Fortinet Fortigate UTM appliances uses the same Certification Authority certificate and same private key across different customers’ installations, which makes it easier for man-in-the-middle attackers to spoof SSL servers by leveraging the presence of the Fortinet_CA_SSLProxy certificate in a list of trusted root certification authorities.
Affected configurations
| Vendor | Product | Version | CPE |
|---|---|---|---|
| fortinet | fortigate-1000c | - | cpe:2.3:h:fortinet:fortigate-1000c:-:*:*:*:*:*:*:* |
| fortinet | fortigate-100d | - | cpe:2.3:h:fortinet:fortigate-100d:-:*:*:*:*:*:*:* |
| fortinet | fortigate-110c | - | cpe:2.3:h:fortinet:fortigate-110c:-:*:*:*:*:*:*:* |
| fortinet | fortigate-1240b | - | cpe:2.3:h:fortinet:fortigate-1240b:-:*:*:*:*:*:*:* |
| fortinet | fortigate-200b | - | cpe:2.3:h:fortinet:fortigate-200b:-:*:*:*:*:*:*:* |
| fortinet | fortigate-20c | - | cpe:2.3:h:fortinet:fortigate-20c:-:*:*:*:*:*:*:* |
| fortinet | fortigate-300c | - | cpe:2.3:h:fortinet:fortigate-300c:-:*:*:*:*:*:*:* |
| fortinet | fortigate-3040b | - | cpe:2.3:h:fortinet:fortigate-3040b:-:*:*:*:*:*:*:* |
| fortinet | fortigate-310b | - | cpe:2.3:h:fortinet:fortigate-310b:-:*:*:*:*:*:*:* |
| fortinet | fortigate-311b | - | cpe:2.3:h:fortinet:fortigate-311b:-:*:*:*:*:*:*:* |
Related
CVSS2
Attack Vector
ADJACENT_NETWORK
Attack Complexity
HIGH
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:A/AC:H/Au:N/C:C/I:P/A:N
AI Score
Confidence
Low
EPSS
Percentile
26.8%