CVE-2018-9192

CVE-2018-9192 describes a vulnerability in Fortinet FortiOS versions 5.4.6 to 5.4.9, 6.0.0, and 6.0.1, specifically when the SSL Deep Inspection feature is active and CPx is in use. This flaw could allow for plaintext recovery of encrypted messages or a Man-in-the-Middle (MiTM) attack against RSA PKCS #1 v1.5 encryption without requiring knowledge of the server's private key. The vulnerability has a CVSS v3.0 score of 5.9 (MEDIUM), indicating a network-based attack with high attack complexity, requiring no user interaction, and leading to high confidentiality impact. While the EPSS score is low (0.00174), suggesting a low probability of exploitation, the potential for sensitive data exposure is significant. Currently, there is no evidence of active exploitation, nor are there publicly available exploit modules in Metasploit, Nuclei, or ExploitDB. Community discussion and media coverage for this CVE are also minimal, suggesting it has not garnered widespread attention.