What’s Vulnerable › Vulnerabilities

CVE-2017-14184

• Severity: high (CVSS 8.8 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2017-12-15 · updated 2026-06-17
• Weakness: CWE-200

Description

An Information Disclosure vulnerability in Fortinet FortiClient for Windows 5.6.0 and below versions, FortiClient for Mac OSX 5.6.0 and below versions and FortiClient SSLVPN Client for Linux 4.4.2334 and below versions allows regular users to see each other's VPN authentication credentials due to improperly secured storage locations.

Affected products

• Fortinet FortiClientWindows: before 5.6.0 — fixed in 5.6.0
• Fortinet Forticlient Sslvpn Client: before 4.4.2334 — fixed in 4.4.2334

How to fix

Upgrade to a fixed version: Fortinet FortiClientWindows 5.6.0; Fortinet Forticlient Sslvpn Client 4.4.2334. Check the vendor advisory for mitigations.

References

• http://www.securityfocus.com/bid/102123
• https://fortiguard.com/advisory/FG-IR-17-214
• http://www.securityfocus.com/bid/102123
• https://fortiguard.com/advisory/FG-IR-17-214

Get alerted when CVE-2017-14184 or the next vulnerability affects your stack