CVE-2018-9192

A plaintext recovery of encrypted messages or a Man-in-the-middle (MiTM) attack on RSA PKCS #1 v1.5 encryption may be possible without knowledge of the server's private key. Fortinet FortiOS 5.4.6 to 5.4.9, 6.0.0 and 6.0.1 are vulnerable by such attack under SSL Deep Inspection feature when CPx being used.

• CWE-203

• https://fortiguard.com/advisory/FG-IR-17-302Vendor Advisory
• https://robotattack.org/Third Party Advisory
• https://www.kb.cert.org/vuls/id/144389Third Party Advisory, US Government Resource
• https://fortiguard.com/advisory/FG-IR-17-302Vendor Advisory
• https://robotattack.org/Third Party Advisory
• https://www.kb.cert.org/vuls/id/144389Third Party Advisory, US Government Resource

Published

Sep 5, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-9182Twonky Server before 8.5.1 has XSS via a modified "language"…
• CVE-2018-9183The Joom Sky JS Jobs extension before 1.2.1 for Joomla! has …
• CVE-2018-9185An information disclosure vulnerability in Fortinet FortiOS …
• CVE-2018-9186A cross-site scripting (XSS) vulnerability in Fortinet Forti…
• CVE-2018-9190A null pointer dereference vulnerability in Fortinet FortiCl…
• CVE-2018-9191A local privilege escalation in Fortinet FortiClient for Win…
• CVE-2018-9193A researcher has disclosed several vulnerabilities against F…7.8
• CVE-2018-9194A plaintext recovery of encrypted messages or a Man-in-the-m…
• CVE-2018-9195Use of a hardcoded cryptographic key in the FortiGuard servi…5.9
• CVE-2018-9196Rejected reason: Not used
• CVE-2018-9197Rejected reason: Not used
• CVE-2018-9198Rejected reason: Not used