Sign-up

ID

VAR-202112-1045


CVE

CVE-2021-41028


TITLE

FortiClientEMS  and  FortiClient  Certificate validation vulnerabilities in

Trust: 0.8

sources: JVNDB: JVNDB-2021-016771

DESCRIPTION

A combination of a use of hard-coded cryptographic key vulnerability [CWE-321] in FortiClientEMS 7.0.1 and below, 6.4.6 and below and an improper certificate validation vulnerability [CWE-297] in FortiClientWindows, FortiClientLinux and FortiClientMac 7.0.1 and below, 6.4.6 and below may allow an unauthenticated and network adjacent attacker to perform a man-in-the-middle attack between the EMS and the FCT via the telemetry protocol. FortiClientEMS and FortiClient contains a certificate validation vulnerability and a vulnerability related to the use of hardcoded credentials.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. Fortinet FortiClient is a mobile terminal security solution developed by Fortinet. The solution provides IPsec and SSL encryption, WAN optimization, endpoint compliance, and two-factor authentication when connected to FortiGate firewall appliances. Fortinet FortiClient has a security vulnerability that could be exploited by an attacker to act as a man-in-the-middle on FortiClient via the telemetry protocol in order to read or write data within the session

Trust: 1.71

sources: NVD: CVE-2021-41028 // JVNDB: JVNDB-2021-016771 // VULHUB: VHN-402298

AFFECTED PRODUCTS

vendor:fortinetmodel:forticlientscope:gteversion:6.0.0

Trust: 1.0

vendor:fortinetmodel:forticlientscope:lteversion:6.0.9

Trust: 1.0

vendor:fortinetmodel:forticlientscope:lteversion:6.4.6

Trust: 1.0

vendor:fortinetmodel:forticlientscope:gteversion:6.2.0

Trust: 1.0

vendor:fortinetmodel:forticlient endpoint management serverscope:lteversion:6.2.9

Trust: 1.0

vendor:fortinetmodel:forticlient endpoint management serverscope:lteversion:6.4.6

Trust: 1.0

vendor:fortinetmodel:forticlient endpoint management serverscope:eqversion:7.0.0

Trust: 1.0

vendor:fortinetmodel:forticlient endpoint management serverscope:eqversion:7.0.1

Trust: 1.0

vendor:fortinetmodel:forticlient endpoint management serverscope:gteversion:6.2.0

Trust: 1.0

vendor:fortinetmodel:forticlientscope:gteversion:6.4.0

Trust: 1.0

vendor:fortinetmodel:forticlientscope:lteversion:6.2.9

Trust: 1.0

vendor:fortinetmodel:forticlientscope:eqversion:7.0.0

Trust: 1.0

vendor:fortinetmodel:forticlientscope:eqversion:7.0.1

Trust: 1.0

vendor:fortinetmodel:forticlient endpoint management serverscope:gteversion:6.4.0

Trust: 1.0

vendor:フォーティネットmodel:forticlientscope:lteversion:7.0.1 and earlier (windows)

Trust: 0.8

vendor:フォーティネットmodel:forticlientscope:lteversion:6.4.6 and earlier (linux)

Trust: 0.8

vendor:フォーティネットmodel:forticlientscope:lteversion:ems 7.0.1 and earlier

Trust: 0.8

vendor:フォーティネットmodel:forticlientscope:lteversion:6.4.6 and earlier (mac)

Trust: 0.8

vendor:フォーティネットmodel:forticlient emsscope:lteversion:6.4.6 and earlier

Trust: 0.8

vendor:フォーティネットmodel:forticlientscope:lteversion:ems 6.4.6 and earlier

Trust: 0.8

vendor:フォーティネットmodel:forticlientscope:lteversion:7.0.1 and earlier (linux)

Trust: 0.8

vendor:フォーティネットmodel:forticlient emsscope:lteversion:7.0.1 and earlier

Trust: 0.8

vendor:フォーティネットmodel:forticlientscope:lteversion:7.0.1 and earlier (mac)

Trust: 0.8

vendor:フォーティネットmodel:forticlientscope:lteversion:6.4.6 and earlier (windows)

Trust: 0.8

sources: JVNDB: JVNDB-2021-016771 // NVD: CVE-2021-41028

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2021-41028
value: HIGH

Trust: 1.0

psirt@fortinet.com: CVE-2021-41028
value: HIGH

Trust: 1.0

NVD: CVE-2021-41028
value: HIGH

Trust: 0.8

CNNVD: CNNVD-202112-535
value: HIGH

Trust: 0.6

VULHUB: VHN-402298
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2021-41028
severity: MEDIUM
baseScore: 5.4
vectorString: AV:A/AC:M/AU:N/C:P/I:P/A:P
accessVector: ADJACENT_NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 5.5
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

VULHUB: VHN-402298
severity: MEDIUM
baseScore: 5.4
vectorString: AV:A/AC:M/AU:N/C:P/I:P/A:P
accessVector: ADJACENT_NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 5.5
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2021-41028
baseSeverity: HIGH
baseScore: 7.5
vectorString: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: ADJACENT
attackComplexity: HIGH
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 1.6
impactScore: 5.9
version: 3.1

Trust: 1.0

psirt@fortinet.com: CVE-2021-41028
baseSeverity: HIGH
baseScore: 8.2
vectorString: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:H
attackVector: ADJACENT
attackComplexity: HIGH
privilegesRequired: NONE
userInteraction: NONE
scope: CHANGED
confidentialityImpact: LOW
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 1.6
impactScore: 6.0
version: 3.1

Trust: 1.0

NVD: CVE-2021-41028
baseSeverity: HIGH
baseScore: 7.5
vectorString: CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: ADJACENT NETWORK
attackComplexity: HIGH
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: VULHUB: VHN-402298 // JVNDB: JVNDB-2021-016771 // CNNVD: CNNVD-202112-535 // NVD: CVE-2021-41028 // NVD: CVE-2021-41028

PROBLEMTYPE DATA

problemtype:CWE-295

Trust: 1.1

problemtype:CWE-798

Trust: 1.1

problemtype:Illegal certificate verification (CWE-295) [NVD evaluation ]

Trust: 0.8

problemtype: Use hard-coded credentials (CWE-798) [NVD evaluation ]

Trust: 0.8

sources: VULHUB: VHN-402298 // JVNDB: JVNDB-2021-016771 // NVD: CVE-2021-41028

THREAT TYPE

remote or local

Trust: 0.6

sources: CNNVD: CNNVD-202112-535

TYPE

trust management problem

Trust: 0.6

sources: CNNVD: CNNVD-202112-535

PATCH

title:FG-IR-21-075url:https://fortiguard.com/advisory/FG-IR-21-075

Trust: 0.8

title:Fortinet FortiClient Repair measures for trust management problem vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=175695

Trust: 0.6

sources: JVNDB: JVNDB-2021-016771 // CNNVD: CNNVD-202112-535

EXTERNAL IDS

db:NVDid:CVE-2021-41028

Trust: 3.3

db:JVNDBid:JVNDB-2021-016771

Trust: 0.8

db:CNNVDid:CNNVD-202112-535

Trust: 0.6

db:CNVDid:CNVD-2022-03936

Trust: 0.1

db:VULHUBid:VHN-402298

Trust: 0.1

sources: VULHUB: VHN-402298 // JVNDB: JVNDB-2021-016771 // CNNVD: CNNVD-202112-535 // NVD: CVE-2021-41028

REFERENCES

url:https://fortiguard.com/advisory/fg-ir-21-075

Trust: 1.7

url:https://nvd.nist.gov/vuln/detail/cve-2021-41028

Trust: 0.8

url:https://vigilance.fr/vulnerability/forticlient-man-in-the-middle-via-telemetry-protocol-37023

Trust: 0.6

sources: VULHUB: VHN-402298 // JVNDB: JVNDB-2021-016771 // CNNVD: CNNVD-202112-535 // NVD: CVE-2021-41028

SOURCES

db:VULHUBid:VHN-402298
db:JVNDBid:JVNDB-2021-016771
db:CNNVDid:CNNVD-202112-535
db:NVDid:CVE-2021-41028

LAST UPDATE DATE

2024-08-14T15:06:36.250000+00:00


SOURCES UPDATE DATE

db:VULHUBid:VHN-402298date:2022-01-04T00:00:00
db:JVNDBid:JVNDB-2021-016771date:2022-12-22T03:27:00
db:CNNVDid:CNNVD-202112-535date:2021-12-23T00:00:00
db:NVDid:CVE-2021-41028date:2022-01-04T15:29:24.433

SOURCES RELEASE DATE

db:VULHUBid:VHN-402298date:2021-12-16T00:00:00
db:JVNDBid:JVNDB-2021-016771date:2022-12-22T00:00:00
db:CNNVDid:CNNVD-202112-535date:2021-12-07T00:00:00
db:NVDid:CVE-2021-41028date:2021-12-16T19:15:08.130