{"id":"CVE-2016-1909","aliases":["EUVD-2016-3000","GHSA-wpg3-7qph-4gvp"],"status":"published","title":"Fortinet FortiAnalyzer before 5.0.12 and 5.2.x before 5.2.5; FortiSwitch 3.3.x before 3.3.3;...","description":"Fortinet FortiAnalyzer before 5.0.12 and 5.2.x before 5.2.5; FortiSwitch 3.3.x before 3.3.3; FortiCache 3.0.x before 3.0.8; and FortiOS 4.1.x before 4.1.11, 4.2.x before 4.2.16, 4.3.x before 4.3.17 and 5.0.x before 5.0.8 have a hardcoded passphrase for the Fortimanager_Access account, which allows remote attackers to obtain administrative access via an SSH session.","severity":{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.71268,"percentile":0.99414,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-264"],"published":"2016-01-15T20:00:00Z","modified":"2026-06-17T00:42:50Z","exploits":[{"source":"exploitdb","id":"EDB-43386","title":"Fortinet FortiGate 4.x \u003c 5.0.7 - SSH Backdoor Access","type":"remote","platform":"linux","date":"2016-01-09","url":"https://www.exploit-db.com/exploits/43386"},{"source":"metasploit","id":"auxiliary/scanner/ssh/fortinet_backdoor","title":"Fortinet SSH Backdoor Scanner","type":"auxiliary","date":"2016-01-09","verified":true,"url":"https://www.rapid7.com/db/modules/auxiliary/scanner/ssh/fortinet_backdoor"}],"products":[{"vendor":"fortinet","product":"fortios"}],"references":[{"url":"http://blog.fortinet.com/post/brief-statement-regarding-issues-found-with-fortios","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"http://seclists.org/fulldisclosure/2016/Jan/26","tags":["mailing-list","x_refsource_FULLDISC","x_transferred","Exploit"]},{"url":"http://packetstormsecurity.com/files/135225/FortiGate-OS-5.0.7-SSH-Backdoor.html","tags":["x_refsource_MISC","x_transferred","Exploit"]},{"url":"http://www.securitytracker.com/id/1034663","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred"]},{"url":"https://twitter.com/esizkur/status/686842135501508608","tags":["x_refsource_MISC","x_transferred"]},{"url":"http://www.fortiguard.com/advisory/multiple-products-ssh-undocumented-login-vulnerability","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://www.exploit-db.com/exploits/39224/","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred","Exploit"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-1909"},{"url":"https://www.exploit-db.com/exploits/39224"},{"url":"https://github.com/advisories/GHSA-wpg3-7qph-4gvp"}],"sources":{"cve":[{"id":"CVE-2016-1909","description":"Fortinet FortiAnalyzer before 5.0.12 and 5.2.x before 5.2.5; FortiSwitch 3.3.x before 3.3.3; FortiCache 3.0.x before 3.0.8; and FortiOS 4.1.x before 4.1.11, 4.2.x before 4.2.16, 4.3.x before 4.3.17 and 5.0.x before 5.0.8 have a hardcoded passphrase for the Fortimanager_Access account, which allows remote attackers to obtain administrative access via an SSH session.","status":"published","published":"2016-01-15T20:00:00Z","modified":"2024-08-05T23:10:40.276Z","updated_at":"2026-11-02T14:33:35.841056Z"}],"euvd":[{"id":"EUVD-2016-3000","description":"Fortinet FortiAnalyzer before 5.0.12 and 5.2.x before 5.2.5; FortiSwitch 3.3.x before 3.3.3; FortiCache 3.0.x before 3.0.8; and FortiOS 4.1.x before 4.1.11, 4.2.x before 4.2.16, 4.3.x before 4.3.17 and 5.0.x before 5.0.8 have a hardcoded passphrase for the Fortimanager_Access account, which allows remote attackers to obtain administrative access via an SSH session.","status":"published","published":"2016-01-15T20:00:00Z","modified":"2024-08-05T23:10:40Z","updated_at":"2026-11-03T02:22:55.100655Z"}],"ghsa":[{"id":"GHSA-wpg3-7qph-4gvp","title":"Fortinet FortiAnalyzer before 5.0.12 and 5.2.x before 5.2.5; FortiSwitch 3.3.x before 3.3.3;...","description":"Fortinet FortiAnalyzer before 5.0.12 and 5.2.x before 5.2.5; FortiSwitch 3.3.x before 3.3.3; FortiCache 3.0.x before 3.0.8; and FortiOS 4.1.x before 4.1.11, 4.2.x before 4.2.16, 4.3.x before 4.3.17 and 5.0.x before 5.0.8 have a hardcoded passphrase for the Fortimanager_Access account, which allows remote attackers to obtain administrative access via an SSH session.","status":"published","published":"2022-05-17T03:51:00Z","modified":"2025-04-12T12:55:55Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:01:25.259545Z"}],"nvd":[{"id":"CVE-2016-1909","description":"Fortinet FortiAnalyzer before 5.0.12 and 5.2.x before 5.2.5; FortiSwitch 3.3.x before 3.3.3; FortiCache 3.0.x before 3.0.8; and FortiOS 4.1.x before 4.1.11, 4.2.x before 4.2.16, 4.3.x before 4.3.17 and 5.0.x before 5.0.8 have a hardcoded passphrase for the Fortimanager_Access account, which allows remote attackers to obtain administrative access via an SSH session.","status":"published","published":"2016-01-15T20:59:00.1Z","modified":"2026-06-17T00:42:50.623Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":10,"vector":"AV:N/AC:L/Au:N/C:C/I:C/A:C","level":"high","assessor":"primary"}],"cwes":["CWE-264"],"updated_at":"2026-11-02T14:03:21.143462Z"}]}}