Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
5.3

Fortigate devices share default SSL proxy certificate, enabling spoofing

CVE-2012-4948 · published 13 years ago
Summary

Fortigate firewalls are shipped with the same SSL proxy certificate and private key for every customer. This makes it possible for attackers to impersonate secure websites and intercept traffic. Change to a unique certificate or disable the default SSL proxy feature as soon as possible.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
fortinet fortigate-1000c All versions
cpe:2.3:h:fortinet:fortigate-1000c:-:*:*:*:*:*:*:*
fortinet fortigate-100d All versions
cpe:2.3:h:fortinet:fortigate-100d:-:*:*:*:*:*:*:*
fortinet fortigate-110c All versions
cpe:2.3:h:fortinet:fortigate-110c:-:*:*:*:*:*:*:*
fortinet fortigate-1240b All versions
cpe:2.3:h:fortinet:fortigate-1240b:-:*:*:*:*:*:*:*
fortinet fortigate-200b All versions
cpe:2.3:h:fortinet:fortigate-200b:-:*:*:*:*:*:*:*
fortinet fortigate-20c All versions
cpe:2.3:h:fortinet:fortigate-20c:-:*:*:*:*:*:*:*
fortinet fortigate-300c All versions
cpe:2.3:h:fortinet:fortigate-300c:-:*:*:*:*:*:*:*
fortinet fortigate-3040b All versions
cpe:2.3:h:fortinet:fortigate-3040b:-:*:*:*:*:*:*:*
fortinet fortigate-310b All versions
cpe:2.3:h:fortinet:fortigate-310b:-:*:*:*:*:*:*:*
fortinet fortigate-311b All versions
cpe:2.3:h:fortinet:fortigate-311b:-:*:*:*:*:*:*:*
fortinet fortigate-3140b All versions
cpe:2.3:h:fortinet:fortigate-3140b:-:*:*:*:*:*:*:*
fortinet fortigate-3240c All versions
cpe:2.3:h:fortinet:fortigate-3240c:-:*:*:*:*:*:*:*
fortinet fortigate-3810a All versions
cpe:2.3:h:fortinet:fortigate-3810a:-:*:*:*:*:*:*:*
fortinet fortigate-3950b All versions
cpe:2.3:h:fortinet:fortigate-3950b:-:*:*:*:*:*:*:*
fortinet fortigate-40c All versions
cpe:2.3:h:fortinet:fortigate-40c:-:*:*:*:*:*:*:*
fortinet fortigate-5001a-sw All versions
cpe:2.3:h:fortinet:fortigate-5001a-sw:-:*:*:*:*:*:*:*
fortinet fortigate-5001b All versions
cpe:2.3:h:fortinet:fortigate-5001b:-:*:*:*:*:*:*:*
fortinet fortigate-5020 All versions
cpe:2.3:h:fortinet:fortigate-5020:-:*:*:*:*:*:*:*
fortinet fortigate-5060 All versions
cpe:2.3:h:fortinet:fortigate-5060:-:*:*:*:*:*:*:*
fortinet fortigate-50b All versions
cpe:2.3:h:fortinet:fortigate-50b:-:*:*:*:*:*:*:*
fortinet fortigate-5101c All versions
cpe:2.3:h:fortinet:fortigate-5101c:-:*:*:*:*:*:*:*
fortinet fortigate-5140b All versions
cpe:2.3:h:fortinet:fortigate-5140b:-:*:*:*:*:*:*:*
fortinet fortigate-600c All versions
cpe:2.3:h:fortinet:fortigate-600c:-:*:*:*:*:*:*:*
fortinet fortigate-60c All versions
cpe:2.3:h:fortinet:fortigate-60c:-:*:*:*:*:*:*:*
fortinet fortigate-620b All versions
cpe:2.3:h:fortinet:fortigate-620b:-:*:*:*:*:*:*:*
fortinet fortigate-800c All versions
cpe:2.3:h:fortinet:fortigate-800c:-:*:*:*:*:*:*:*
fortinet fortigate-80c All versions
cpe:2.3:h:fortinet:fortigate-80c:-:*:*:*:*:*:*:*
fortinet fortigate-voice-80c All versions
cpe:2.3:h:fortinet:fortigate-voice-80c:-:*:*:*:*:*:*:*
fortinet fortigaterugged-100c All versions
cpe:2.3:h:fortinet:fortigaterugged-100c:-:*:*:*:*:*:*:*
Original advisory text
The default configuration of Fortinet Fortigate UTM appliances uses the same Certification Authority certificate and same private key across different customers' installations, which makes it easie...
The default configuration of Fortinet Fortigate UTM appliances uses the same Certification Authority certificate and same private key across different customers' installations, which makes it easier for man-in-the-middle attackers to spoof SSL servers by leveraging the presence of the Fortinet_CA_SSLProxy certificate in a list of trusted root certification authorities.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker partial control (estimated)
Severity
5.3 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-295Improper Certificate Validation
Timeline
Published14 Nov 2012
Updated4 Nov 2026
First seen29 Sep 2026
Sources
CVE-2012-4948 · NVD
Track software like this
Free during beta