What is CVE-2017-17543?

CVE-2017-17543 is a high-severity vulnerability in Fortinet Forticlient, classified under Inadequate Encryption Strength. CVSS score: 7.5/10. Published 2018-04-26.

How severe is CVE-2017-17543?

High severity. CVSS v3 base score is 7.5 out of 10.

Vulnerability in Fortinet Forticlient

CVE-2017-17543

Users' VPN authentication credentials are unsafely encrypted in Fortinet FortiClient for Windows 5.6.0 and below versions, FortiClient for Mac OSX 5.6.0 and below versions and FortiClient SSLVPN Client for Linux 4.4.2335 and below versions, due to the use of a static encryption key and weak encryption algorithms.

EPSS: 0.004 (37.4th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.5 (High). Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.

Affected products

Fortinet Forticlient
Fortinet Forticlient_sslvpn_client
Fortinet, Inc. Forticlient For Mac Osx — versions 5.6.0 and below versions
Fortinet, Inc. Forticlient For Windows — versions 5.6.0 and below versions
Fortinet, Inc. Forticlient Sslvpn Client For Linux — versions 4.4.2335 and below versions

Weakness classification (CWE)

CWE-326 — Inadequate Encryption Strength

References

psirt@fortinet.com (x_refsource_CONFIRM)

Frequently asked questions

What is CVE-2017-17543?: CVE-2017-17543 is a high-severity vulnerability in Fortinet Forticlient, classified under Inadequate Encryption Strength. CVSS score: 7.5/10. Published 2018-04-26.
How severe is CVE-2017-17543?: High severity. CVSS v3 base score is 7.5 out of 10.