CVE-2016-1909
CriticalSummary
Fortinet FortiAnalyzer, FortiSwitch, FortiCache, and FortiOS have a hardcoded passphrase for the Fortimanager_Access account, allowing remote attackers to gain administrative access via an SSH session.
Risk Assessment
Exploitation of this vulnerability could lead to unauthorized access to systems, posing a significant security threat to the organization.
Recommendation
It is recommended to update to the latest software versions to remove the hardcoded passphrase and secure system access.
Original NVD description (English source)
Fortinet FortiAnalyzer before 5.0.12 and 5.2.x before 5.2.5; FortiSwitch 3.3.x before 3.3.3; FortiCache 3.0.x before 3.0.8; and FortiOS 4.1.x before 4.1.11, 4.2.x before 4.2.16, 4.3.x before 4.3.17 and 5.0.x before 5.0.8 have a hardcoded passphrase for the Fortimanager_Access account, which allows remote attackers to obtain administrative access via an SSH session.