CVE-2023-37936 is a critical vulnerability affecting Fortinet FortiSwitch versions 7.4.0, 7.2.0-7.2.5, 7.0.0-7.0.7, 6.4.0-6.4.13, 6.2.0-6.2.7, and 6.0.0-6.0.7. This flaw stems from the use of a hard-coded cryptographic key, enabling unauthenticated attackers to execute arbitrary code or commands through crafted requests. With a CVSS score of 9.8, it poses a severe risk due to its network-based attack vector, low complexity, and complete compromise of confidentiality, integrity, and availability. While not yet listed in CISA's KEV catalog, media reports indicate active exploitation, and the vulnerability has garnered significant community discussion, underscoring the urgency for patching.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 6.0.0, < 6.2.8CPE matchmatch criteria | cpe:2.3:o:fortinet:fortiswitch:*:*:*:*:*:*:*:* | ||
>= 6.4.0, < 6.4.14CPE matchmatch criteria | cpe:2.3:o:fortinet:fortiswitch:*:*:*:*:*:*:*:* | ||
>= 7.0.0, < 7.0.8CPE matchmatch criteria | cpe:2.3:o:fortinet:fortiswitch:*:*:*:*:*:*:*:* | ||
>= 7.2.0, < 7.2.6CPE matchmatch criteria | cpe:2.3:o:fortinet:fortiswitch:*:*:*:*:*:*:*:* | ||
7.4.0CPE matchmatch criteria | cpe:2.3:o:fortinet:fortiswitch:7.4.0:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.