CVE-2015-1453: Medium severity fortinet forticlient vulnerability
Published Feb 2, 2015
·Updated
The qm class in Fortinet FortiClient 5.2.3.091 for Android uses a hardcoded encryption key of FoRtInEt!AnDrOiD, which makes it easier for attackers to obtain passwords and possibly other sensitive data by leveraging the key to decrypt data in the Shared Preferences.
Affected Software
1 affected component
Fortinet Forticlient Android<=5.2.3.091
Event History
Feb 2, 2015
CVE Published
via MITRE·04:00 PM
Data Sourced
via MITRE·04:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2015-1453?
CVE-2015-1453 has been classified as a medium severity vulnerability.
2
How do I fix CVE-2015-1453?
To mitigate CVE-2015-1453, upgrade to the latest version of FortiClient that does not use hardcoded encryption keys.
3
What type of data is exposed in CVE-2015-1453?
CVE-2015-1453 exposes sensitive user data, including passwords stored in Shared Preferences.
4
Which versions of FortiClient are affected by CVE-2015-1453?
FortiClient versions up to and including 5.2.3.091 for Android are affected by CVE-2015-1453.
5
Who is the vendor for CVE-2015-1453?
The vendor for CVE-2015-1453 is Fortinet.