Cyber Resilience

CVE-2016-1909

Fortinet Fortios ≤ 4.3.16

Public PoCHigh EPSS
Published
15 January 2016
Modified
06 May 2026
CVSS Score v3 9.8
Click a component to see what it means
Raw vectorCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.71 99.4th percentile
Risk Priority 97 floored blend · peak EPSS

CVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.

Summary

CVE-2016-1909 is a critical-severity an unspecified weakness vulnerability in Fortinet Fortios. Its CVSS base score is 9.8 (Critical).

Operationally, ranked in the top 0.6% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

EU & UK References

Vulnerability Data

Fortinet FortiAnalyzer before 5.0.12 and 5.2.x before 5.2.5; FortiSwitch 3.3.x before 3.3.3; FortiCache 3.0.x before 3.0.8; and FortiOS 4.1.x before 4.1.11, 4.2.x before 4.2.16, 4.3.x before 4.3.17 and 5.0.x before 5.0.8 have a hardcoded passphrase for the Fortimanager_Access account, which…

more

allows remote attackers to obtain administrative access via an SSH session.

CWE(s)
CWE-264

Related Threats

CVEs Like This One

CVE-2025-58903Same product: Fortinet Fortios
CVE-2024-46670Same product: Fortinet Fortios
CVE-2022-41328Same product: Fortinet Fortios
CVE-2023-44247Same product: Fortinet Fortios
CVE-2025-47294Same product: Fortinet Fortios
CVE-2023-29182Same product: Fortinet Fortios
CVE-2024-40591Same product: Fortinet Fortios
CVE-2023-28001Same product: Fortinet Fortios
CVE-2023-47537Same product: Fortinet Fortios
CVE-2024-52963Same product: Fortinet Fortios

Affected Assets

fortinet
fortios
5.0, 5.0.0, 5.0.1, 5.0.2, 5.0.3 · ≤ 4.3.16

Mitigating Controls

No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.

References