CVE-2015-1571 | BDVDB-2026-67967 Detail

Description#

The CAPWAP DTLS protocol implementation in Fortinet FortiOS 5.0 Patch 7 build 4457 uses the same certificate and private key across different customers' installations, which makes it easier for man-in-the-middle attackers to spoof SSL servers by leveraging the Fortinet_Factory certificate and private key. NOTE: FG-IR-15-002 says "The Fortinet_Factory certificate is unique to each device ... An attacker cannot therefore stage a MitM attack.

Impact#

Weaknesses#

References#

Exploit#

History#

1. Version 12015-02-10Record published in the CVE List.
2. Version 22024-08-06Most recent update recorded in the CVE List.