CVE-2019-15703

CVE-2019-15703 describes an Insufficient Entropy vulnerability in the Pseudo-Random Number Generator (PRNG) of Fortinet FortiOS versions 6.2.1, 6.2.0, and 6.0.8 and below, specifically impacting FortiGate VM models without hardware TRNG or built-in TRNG seed support. This flaw could theoretically allow an attacker to recover the long-term ECDSA secret in a TLS client using RSA handshake and mutual ECDSA authentication. The vulnerability has a CVSS score of 7.5 (HIGH), indicating a network-based attack with low complexity and high confidentiality impact, but no integrity or availability impact. There is currently no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage.