CVE-2017-17543: Users' VPN authentication credentials are unsafely encrypted in Fortinet FortiClient for Windows 5.6.0 and below versions, FortiClient for Mac OSX 5.6.0 and…

PriorityP338high7.5CVSS 3.0

AVNACLPRNUINSUCHINAN

EPSS

0.40%

34.3th percentile

Users' VPN authentication credentials are unsafely encrypted in Fortinet FortiClient for Windows 5.6.0 and below versions, FortiClient for Mac OSX 5.6.0 and below versions and FortiClient SSLVPN Client for Linux 4.4.2335 and below versions, due to the use of a static encryption key and weak encryption algorithms.

Affected

8 ranges

Vendor	Product	Version range	Fixed in
fortinet	forticlient	<= 5.6.0	—
fortinet	forticlient	—	—
fortinet	forticlient_sslvpn_client	<= 4.4.2335	—
fortinet	forticlientsslvpnclient	—	—
fortinet	fortinet	—	—
fortinet_inc	forticlient_for_mac_osx	—	—
fortinet_inc	forticlient_for_windows	—	—
fortinet_inc	forticlient_sslvpn_client_for_linux	—	—

CVSS provenance

nvdv3.07.5HIGHCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.