CVE-2017-17543

HIGH

FortiClient < 5.6.0 and FortiClient SSLVPN Client < 4.4.2335 - Inadequate Encryption Strength

Title source: llm
STIX 2.1

Description

Users' VPN authentication credentials are unsafely encrypted in Fortinet FortiClient for Windows 5.6.0 and below versions, FortiClient for Mac OSX 5.6.0 and below versions and FortiClient SSLVPN Client for Linux 4.4.2335 and below versions, due to the use of a static encryption key and weak encryption algorithms.

References (1)

Core 1
Core References
Vendor Advisory x_refsource_confirm
https://fortiguard.com/advisory/FG-IR-17-214

Scores

CVSS v3 7.5
EPSS 0.0007
EPSS Percentile 20.8%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact partial

Details

CWE
CWE-326
Status published
Products (2)
fortinet/forticlient < 5.6.0 (2 CPE variants)
fortinet/forticlient_sslvpn_client < 4.4.2335
Published Apr 26, 2018
Tracked Since Feb 18, 2026