CVE-2019-16150: 
FortiClient vulnerability analysis and mitigation

A vulnerability identified as CVE-2019-16150 was discovered in FortiClient for Windows versions prior to 6.4.0. The issue involves the use of a hard-coded cryptographic key to encrypt sensitive data in local storage and configuration files. The vulnerability was disclosed and documented in June 2020 (NVD, CERT-EU).

The vulnerability, discovered by Gregory Draperi, is characterized by the use of a hard-coded cryptographic key for encrypting security-sensitive data in the configuration file. The issue has been assigned a CVSS v3.1 base score of 5.5 (Medium) with the vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. The vulnerability is classified under CWE-798 (Use of Hard-coded Credentials) (NVD, CERT-EU).

The vulnerability allows an attacker with access to the local storage or configuration backup file to decrypt sensitive data using the known hard-coded key. This could lead to the disclosure of security-sensitive configuration information on the target system (CERT-EU).

The vulnerability can be exploited by an attacker with access to the configuration file or its backup. Additionally, it can be exploited remotely by an authenticated user of the system where the configuration file resides. As of the initial disclosure, no public exploits were available (CERT-EU).

The recommended mitigation is to upgrade to FortiClient for Windows version 6.4.0 or above, which addresses the hard-coded cryptographic key issue (CERT-EU).