by Kastro
Paper/Archive/CVE-2023-37936

CVE-2023-37936

Fortinet FortiSwitch — A use of hard-coded cryptographic key in Fortinet FortiSwitch version 7.4.0 and 7.2.0 through 7.2.5 and 7.0.0 through 7.0.7 and 6.4.0 thr…

EPSS 1.0%CVSS 9.8
critical.is priorityof 100
42
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 62.5.625 × 2012.5No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

A use of hard-coded cryptographic key in Fortinet FortiSwitch version 7.4.0 and 7.2.0 through 7.2.5 and 7.0.0 through 7.0.7 and 6.4.0 through 6.4.13 and 6.2.0 through 6.2.7 and 6.0.0 through 6.0.7 allows attacker to execute unauthorized code or commands via crafted requests.

Affected

ProductAffectedFixed inSource
FortiSwitch7.4.0–CNA
FortiSwitch7.2.0 – 7.2.5–CNA
FortiSwitch7.0.0 – 7.0.7–CNA
FortiSwitch6.4.0 – 6.4.13–CNA
FortiSwitch6.2.0 – 6.2.7–CNA
FortiSwitch6.0.0 – 6.0.7–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
fortinet (CNA)9.6CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:X/RC:C
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

reffortiguard.com/psirt/FG-IR-23-260