Critical Vulnerability in FortiSwitch (CVE-2023-37936)
CVSSv3 Score: Base 9.6 Critical
BACKGROUND
Another critical vulnerability addressed by Fortinet is CVE-2023-37936, a hard-coded cryptographic key in Fortinet FortiSwitch. This flaw allows a remote, unauthenticated attacker with access to the hard-coded key to execute unauthorized code via crafted cryptographic requests.
IMPACT
- Unauthorized code execution by exploiting the hard-coded cryptographic key flaw.
- Bypassing authentication mechanisms through crafted cryptographic requests, allowing
attackers to gain unauthorized access to the system. - Gaining control over FortiSwitch devices, potentially compromising the entire internal
network they manage. - Attackers can intercept or manipulate sensitive data transmitted through or stored on
compromised devices. - Attackers can disrupt the network by sending harmful data, changing settings, or shutting
down devices using the compromised devices.
AFFECTED PRODUCTS
| Product | Affected Versions | |
| 1 | FortiSwitch 7.4 | 7.4.0 |
| 2 | FortiSwitch 7.2 | 7.2.0 through 7.2.5 |
| 3 | FortiSwitch 7.0 | 7.0.0 through 7.0.7 |
| 4 | FortiSwitch 6.4 | 6.4.0 through 6.4.13 |
| 5 | FortiSwitch 6.2 | 6.2.0 through 6.2.7 |
| 6 | FortiSwitch 6.0 | 6.0.0 through 6.0.7 |
RECOMMENDATIONS
- Apply the appropriate updates provided by Fortinet to vulnerable systems after thorough
testing. - Regularly review system logs and monitor for any unauthorized access or unusual activities.
- Limit access to management interfaces and ensure they are not exposed to untrusted
networks.
REFERENCES
https://www.fortiguard.com/psirt/FG-IR-23-260
https://www.securityweek.com/fortinet-confirms-new-zero-day-exploitation/