The default configuration of Fortinet Fortigate UTM appliances uses the same…
Priority LOW 24CWE-295Published · Updated
Key facts
- Attack vector
- Adjacent network
- Privileges required
- None
- User interaction
- — Not recorded in CVSS 2.0
- Attack complexity
- High
- Impact type
- Spoofing
- Confidentiality · integrity · availability
- Complete · Partial · None
- Fix status
- No fix listed
Attack profile from CVSS 2.0 · NVD. Fix status from CNA. Impact type from CWE-295.
Summary
The default configuration of Fortinet Fortigate UTM appliances uses the same Certification Authority certificate and same private key across different customers' installations, which makes it easier for man-in-the-middle attackers to spoof SSL servers by leveraging the presence of the Fortinet_CA_SSLProxy certificate in a list of trusted root certification authorities.
Why it matters now
EPSS 0.00333 26th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 29
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:h:fortinet:fortigate-1000c:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Fortinet |
| cpe:2.3:h:fortinet:fortigate-100d:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Fortinet |
| cpe:2.3:h:fortinet:fortigate-110c:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Fortinet |
| cpe:2.3:h:fortinet:fortigate-1240b:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Fortinet |
| cpe:2.3:h:fortinet:fortigate-200b:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Fortinet |
| cpe:2.3:h:fortinet:fortigate-20c:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Fortinet |
| cpe:2.3:h:fortinet:fortigate-300c:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Fortinet |
| cpe:2.3:h:fortinet:fortigate-3040b:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Fortinet |
| cpe:2.3:h:fortinet:fortigate-310b:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Fortinet |
| cpe:2.3:h:fortinet:fortigate-311b:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Fortinet |
- cpe:2.3:h:fortinet:fortigate-1000c:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Fortinet
- cpe:2.3:h:fortinet:fortigate-100d:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Fortinet
- cpe:2.3:h:fortinet:fortigate-110c:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Fortinet
- cpe:2.3:h:fortinet:fortigate-1240b:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Fortinet
- cpe:2.3:h:fortinet:fortigate-200b:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Fortinet
- cpe:2.3:h:fortinet:fortigate-20c:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Fortinet
- cpe:2.3:h:fortinet:fortigate-300c:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Fortinet
- cpe:2.3:h:fortinet:fortigate-3040b:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Fortinet
- cpe:2.3:h:fortinet:fortigate-310b:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Fortinet
- cpe:2.3:h:fortinet:fortigate-311b:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Fortinet
Show 19 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:h:fortinet:fortigate-3140b:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Fortinet |
| cpe:2.3:h:fortinet:fortigate-3240c:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Fortinet |
| cpe:2.3:h:fortinet:fortigate-3810a:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Fortinet |
| cpe:2.3:h:fortinet:fortigate-3950b:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Fortinet |
| cpe:2.3:h:fortinet:fortigate-40c:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Fortinet |
| cpe:2.3:h:fortinet:fortigate-5001a-sw:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Fortinet |
| cpe:2.3:h:fortinet:fortigate-5001b:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Fortinet |
| cpe:2.3:h:fortinet:fortigate-5020:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Fortinet |
| cpe:2.3:h:fortinet:fortigate-5060:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Fortinet |
| cpe:2.3:h:fortinet:fortigate-50b:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Fortinet |
| cpe:2.3:h:fortinet:fortigate-5101c:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Fortinet |
| cpe:2.3:h:fortinet:fortigate-5140b:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Fortinet |
| cpe:2.3:h:fortinet:fortigate-600c:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Fortinet |
| cpe:2.3:h:fortinet:fortigate-60c:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Fortinet |
| cpe:2.3:h:fortinet:fortigate-620b:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Fortinet |
| cpe:2.3:h:fortinet:fortigate-800c:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Fortinet |
| cpe:2.3:h:fortinet:fortigate-80c:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Fortinet |
| cpe:2.3:h:fortinet:fortigate-voice-80c:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Fortinet |
| cpe:2.3:h:fortinet:fortigaterugged-100c:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Fortinet |
- cpe:2.3:h:fortinet:fortigate-3140b:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Fortinet
- cpe:2.3:h:fortinet:fortigate-3240c:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Fortinet
- cpe:2.3:h:fortinet:fortigate-3810a:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Fortinet
- cpe:2.3:h:fortinet:fortigate-3950b:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Fortinet
- cpe:2.3:h:fortinet:fortigate-40c:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Fortinet
- cpe:2.3:h:fortinet:fortigate-5001a-sw:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Fortinet
- cpe:2.3:h:fortinet:fortigate-5001b:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Fortinet
- cpe:2.3:h:fortinet:fortigate-5020:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Fortinet
- cpe:2.3:h:fortinet:fortigate-5060:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Fortinet
- cpe:2.3:h:fortinet:fortigate-50b:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Fortinet
- cpe:2.3:h:fortinet:fortigate-5101c:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Fortinet
- cpe:2.3:h:fortinet:fortigate-5140b:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Fortinet
- cpe:2.3:h:fortinet:fortigate-600c:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Fortinet
- cpe:2.3:h:fortinet:fortigate-60c:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Fortinet
- cpe:2.3:h:fortinet:fortigate-620b:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Fortinet
- cpe:2.3:h:fortinet:fortigate-800c:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Fortinet
- cpe:2.3:h:fortinet:fortigate-80c:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Fortinet
- cpe:2.3:h:fortinet:fortigate-voice-80c:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Fortinet
- cpe:2.3:h:fortinet:fortigaterugged-100c:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Fortinet
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2012-4948
- 2026-10-03 Alias added: GHSA-p5m6-f3fp-3v88
More Fortinet Fortigate-1000c vulnerabilities
- TI-2013-01234 Multiple cross-site request forgery (CSRF) vulnerabilities in Fortinet FortiOS on… CVSS 2.0MEDIUM 5.1
Sources
- CVE-2012-4948 · CVE Program
- CVE-2012-4948 · NVD
- FIRST EPSS
- GHSA-p5m6-f3fp-3v88 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences