CVE-2018-9195

MediumCVSS 5.9/10Last modified Jun 17, 2026

Description

Use of a hardcoded cryptographic key in the FortiGuard services communication protocol may allow a Man in the middle with knowledge of the key to eavesdrop on and modify information (URL/SPAM services in FortiOS 5.6, and URL/SPAM/AV services in FortiOS 6.0.; URL rating in FortiClient) sent and received from Fortiguard severs by decrypting these messages. Affected products include FortiClient for Windows 6.0.6 and below, FortiOS 6.0.7 and below, FortiClient for Mac OS 6.2.1 and below.

Metrics

CVSS 3.1 5.9/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-798

Affected software

Vendor	Product	Versions
Fortinet	FortiClient for Windows	FortiClient for Windows 6.0.6 and below
Fortinet	FortiOS	FortiOS 6.0.7 and below
Fortinet	FortiClient for Mac OS	FortiClient for Mac OS 6.2.1 and below

References

https://fortiguard.com/advisory/FG-IR-18-100Third Party Advisory
https://fortiguard.com/advisory/FG-IR-18-100Third Party Advisory

Timeline

Published: Nov 21, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-92057.5Vulnerability in avatar_uploader v7.x-1.0-beta8 , The code in view.php doesn't verify users or sanitize the file path.CVE-2018-92069.8Unauthenticated arbitrary file upload vulnerability in Blueimp jQuery-File-Upload <= v9.22.0 CVE-2018-92079.8Arbitrary file upload in jQuery Upload File <= 4.0.2 CVE-2018-92089.8Unauthenticated arbitrary file upload vulnerability in jQuery Picture Cut <= v1.1Beta CVE-2018-92099.8Unauthenticated arbitrary file upload vulnerability in FineUploader php-traditional-server <= v1.2.2 CVE-2018-92309.8In OpenResty through 1.13.6.1, URI parameters are obtained using the ngx.req.get_uri_args and ngx.req.get_post_args functions that ignore pa CVE-2018-92327.8Due to the lack of firmware authentication in the upgrade process of T&W WIFI Repeater BE126 devices, an attacker can craft a malicious firm CVE-2018-92337.8Sophos Endpoint Protection 10.7 uses an unsalted SHA-1 hash for password storage in %PROGRAMDATA%\Sophos\Sophos Anti-Virus\Config\machine.xm CVE-2018-92347.5GnuPG 2.2.4 and 2.2.5 does not enforce a configuration in which key certification requires an offline master Certify key, which results in a CVE-2018-92356.1iScripts SonicBB 1.0 has Reflected Cross-Site Scripting via the query parameter to search.php.CVE-2018-92365.4iScripts EasyCreate 3.2.1 has Stored Cross-Site Scripting in the "Site title" field.CVE-2018-92375.4iScripts EasyCreate 3.2.1 has Stored Cross-Site Scripting in the "Site Description" field.