« Back to list

CVE-2014-0351

Status: ModifiedMedium (5.4)—

The FortiManager protocol service in Fortinet FortiOS before 4.3.16 and 5.x before 5.0.8 on FortiGate devices does not prevent use of anonymous ciphersuites, which makes it easier for man-in-the-middle attackers to obtain sensitive information or interfere with communications by modifying the client-server data stream.

CVSS

Exploitation probability (EPSS)

EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).

Affected technologies (1)

Fortinet — Fortios

CWEs

References

Raw JSON (NVD)

Show
{
  "id": "CVE-2014-0351",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 5.4,
          "accessVector": "ADJACENT_NETWORK",
          "vectorString": "AV:A/AC:M/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 5.5,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ]
  },
  "affected": [
    {
      "source": "cret@cert.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2014-09-10T18:55:02.643",
  "references": [
    {
      "url": "http://www.fortiguard.com/advisory/FG-IR-14-006/",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cret@cert.org"
    },
    {
      "url": "http://www.kb.cert.org/vuls/id/730964",
      "tags": [
        "Third Party Advisory",
        "US Government Resource"
      ],
      "source": "cret@cert.org"
    },
    {
      "url": "http://www.securityfocus.com/bid/69754",
      "source": "cret@cert.org"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/96119",
      "source": "cret@cert.org"
    },
    {
      "url": "http://www.fortiguard.com/advisory/FG-IR-14-006/",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.kb.cert.org/vuls/id/730964",
      "tags": [
        "Third Party Advisory",
        "US Government Resource"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/69754",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/96119",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-310"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The FortiManager protocol service in Fortinet FortiOS before 4.3.16 and 5.x before 5.0.8 on FortiGate devices does not prevent use of anonymous ciphersuites, which makes it easier for man-in-the-middle attackers to obtain sensitive information or interfere with communications by modifying the client-server data stream."
    },
    {
      "lang": "es",
      "value": "El servicio de protocolo FortiManager en Fortinet FortiOS anterior a 4.3.16 y 5.x anterior a 5.0.8 en los dispositivos FortiGate devices no previene el uso de los suites de cifrado anónimos, lo que facilita a atacantes man-in-the-middle obtener información sensible o interferir con las comunicaciones mediante la modificación del flujo de datos del cliente-servidor."
    }
  ],
  "lastModified": "2026-06-17T00:02:51.170",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "493FE61C-5C97-46C4-8090-DFAA4D68B519",
              "versionEndIncluding": "4.3.15"
            },
            {
              "criteria": "cpe:2.3:o:fortinet:fortios:4.3.10:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B75D8F35-830C-498C-B658-AE89154BEB8C"
            },
            {
              "criteria": "cpe:2.3:o:fortinet:fortios:4.3.12:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D6CBC65E-6DF2-406D-9037-897218AB9257"
            },
            {
              "criteria": "cpe:2.3:o:fortinet:fortios:4.3.13:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0AB85DAD-03EA-4B16-8FF8-F02ACEF0EE1F"
            },
            {
              "criteria": "cpe:2.3:o:fortinet:fortios:4.3.14:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A97B341D-3B9D-4D37-8D5B-6062BE1C3AC4"
            },
            {
              "criteria": "cpe:2.3:o:fortinet:fortios:5.0.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1E542BE2-14FC-4BA8-890C-7DA81F33F032"
            },
            {
              "criteria": "cpe:2.3:o:fortinet:fortios:5.0.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9C172379-F6BA-4343-831A-62004E742C6D"
            },
            {
              "criteria": "cpe:2.3:o:fortinet:fortios:5.0.4:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "516597D9-086E-4668-A40B-473F38125F92"
            },
            {
              "criteria": "cpe:2.3:o:fortinet:fortios:5.0.5:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D62F480B-D8CA-4F5C-8034-C0AE73F26B67"
            },
            {
              "criteria": "cpe:2.3:o:fortinet:fortios:5.0.6:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F435F408-EC5B-42A0-9E3C-4DE5D702ACAE"
            },
            {
              "criteria": "cpe:2.3:o:fortinet:fortios:5.0.7:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "823C8357-E638-4EAE-B231-3B60263FFE52"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cret@cert.org"
}