Advisory
17 JANUARY 2025
Background
CVSSv3 Score: Base 9.6 Critical
Another critical vulnerability addressed by Fortinet is CVE-2023-37936, a hard-coded cryptographic key in Fortinet FortiSwitch. This flaw allows a remote, unauthenticated attacker with access to the hard-coded key to execute unauthorized code via crafted cryptographic requests.
Impact
- Unauthorized code execution by exploiting the hard-coded cryptographic key flaw.
- Bypassing authentication mechanisms through crafted cryptographic requests, allowing attackers to gain unauthorized access to the system.
- Gaining control over FortiSwitch devices, potentially compromising the entire internal network they manage.
- Attackers can intercept or manipulate sensitive data transmitted through or stored on compromised devices.
- Attackers can disrupt the network by sending harmful data, changing settings, or shutting down devices using the compromised devices.
Affected Products
| Product | Affected Versions |
|---|---|
| FortiSwitch 7.4 | 7.4.0 |
| FortiSwitch 7.2 | 7.2.0 through 7.2.5 |
| FortiSwitch 7.0 | 7.0.0 through 7.0.7 |
| FortiSwitch 6.4 | 6.4.0 through 6.4.13 |
| FortiSwitch 6.2 | 6.2.0 through 6.2.7 |
| FortiSwitch 6.0 | 6.0.0 through 6.0.7 |
Recommendations
- Apply the appropriate updates provided by Fortinet to vulnerable systems after thorough testing.
- Regularly review system logs and monitor for any unauthorized access or unusual activities.
- Limit access to management interfaces and ensure they are not exposed to untrusted networks.
References
