CVE-2016-8495

HighCVSS 7.4/10Last modified Jun 17, 2026

Description

An improper certificate validation vulnerability in Fortinet FortiManager 5.0.6 through 5.2.7 and 5.4.0 through 5.4.1 allows remote attacker to spoof a trusted entity by using a man-in-the-middle (MITM) attack via the Fortisandbox devices probing feature.

Metrics

CVSS 3.0 7.4/10CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-200

Affected software

Vendor	Product	Versions
Fortinet	FortiManager	5.0.6 to 5.2.7; 5.4.0 to 5.4.1

References

http://www.securityfocus.com/bid/96157Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1037805
https://fortiguard.com/advisory/FG-IR-16-055Vendor Advisory
http://www.securityfocus.com/bid/96157Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1037805
https://fortiguard.com/advisory/FG-IR-16-055Vendor Advisory

Timeline

Published: Feb 13, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2016

CVE-2016-85015.3Security WiFi bypass in Yandex Browser from version 15.10 to 15.12 allows remote attacker to sniff traffic in open or WEP-protected wi-fi ne CVE-2016-85027.3Yandex Protect Anti-phishing warning in Yandex Browser for desktop from version 15.12.0 to 16.2 could be used by remote attacker for brute-f CVE-2016-85037.3Yandex Protect Anti-phishing warning in Yandex Browser for desktop from version 16.7 to 16.9 could be used by remote attacker for brute-forc CVE-2016-85044.3CSRF of synchronization form in Yandex Browser for desktop before version 16.6 could be used by remote attacker to steal saved data in brows CVE-2016-85056.1XSS in Yandex Browser BookReader in Yandex browser for desktop for versions before 16.6. could be used by remote attacker for evaluation arb CVE-2016-85066.1XSS in Yandex Browser Translator in Yandex browser for desktop for versions from 15.12 to 16.2 could be used by remote attacker for evaluati CVE-2016-85076.5Yandex Browser for iOS before 16.10.0.2357 does not properly restrict processing of facetime:// URLs, which allows remote attackers to initi CVE-2016-85086.5Yandex Browser for desktop before 17.1.1.227 does not show Protect (similar to Safebrowsing in Chromium) warnings in web-sites with special CVE-2016-85119.8A Remote Code Execution vulnerability in HPE Network Automation using RPCServlet and Java Deserialization version v9.1x, v9.2x, v10.00, v10.CVE-2016-85129.8A Remote Code Execution vulnerability in all versions of HPE LoadRunner and Performance Center was found.CVE-2016-85138.0A Cross-Site Request Forgery (CSRF) vulnerability in HPE Version Control Repository Manager (VCRM) was found. The problem impacts all versio CVE-2016-85146.5A remote information disclosure in HPE Version Control Repository Manager (VCRM) was found. The problem impacts all versions prior to 7.6.