CVE-2023-37936
📋 TL;DR
This vulnerability allows attackers to execute arbitrary code or commands on affected FortiSwitch devices by exploiting hard-coded cryptographic keys. Attackers can send specially crafted requests to compromise the device. All organizations running vulnerable FortiSwitch firmware versions are affected.
💻 Affected Systems
- Fortinet FortiSwitch
📦 What is this software?
Fortiswitch by Fortinet
Fortiswitch by Fortinet
Fortiswitch by Fortinet
Fortiswitch by Fortinet
Fortiswitch by Fortinet
⚠️ Risk & Real-World Impact
Worst Case
Complete device compromise leading to network takeover, data exfiltration, lateral movement to other systems, and persistent backdoor installation.
Likely Case
Unauthorized administrative access to the switch, configuration changes, traffic interception, and potential network disruption.
If Mitigated
Limited impact if network segmentation isolates switches, access controls restrict management interfaces, and monitoring detects anomalous requests.
🎯 Exploit Status
The hard-coded key nature makes exploitation straightforward once the key is discovered. No authentication required for exploitation.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Update to FortiSwitch firmware versions: 7.4.1 or above, 7.2.6 or above, 7.0.8 or above, 6.4.14 or above, 6.2.8 or above, 6.0.8 or above
Vendor Advisory: https://fortiguard.com/psirt/FG-IR-23-260
Restart Required: Yes
Instructions:
1. Download the patched firmware from Fortinet support portal. 2. Backup current configuration. 3. Upload firmware to FortiSwitch via GUI or CLI. 4. Reboot the switch to apply the update. 5. Verify the new firmware version is installed.
🔧 Temporary Workarounds
Restrict Management Interface Access
allLimit access to FortiSwitch management interfaces to trusted IP addresses only
config system interface
edit <management_interface>
set allowaccess https ssh ping
set trust-ip-list <trusted_ips>
end
Disable Unnecessary Management Protocols
allTurn off management protocols not required for operations
config system interface
edit <management_interface>
set allowaccess <required_protocols_only>
end
🧯 If You Can't Patch
- Isolate FortiSwitch management interfaces to dedicated VLAN with strict access controls
- Implement network monitoring for anomalous requests to switch management interfaces
🔍 How to Verify
Check if Vulnerable:
Check FortiSwitch firmware version via GUI (System > Dashboard) or CLI (get system status)Check Version:
get system status | grep VersionVerify Fix Applied:
Confirm firmware version is updated to patched versions listed in vendor advisory📡 Detection & Monitoring
Log Indicators:
- Unusual authentication attempts to switch management interface
- Configuration changes from unexpected sources
- Failed firmware update attempts
Network Indicators:
- Unusual traffic patterns to switch management ports (typically 443, 22)
- Requests containing crafted payloads to management interfaces
SIEM Query:
source="fortiswitch" AND (event_type="config_change" OR event_type="auth_failure") AND src_ip NOT IN [trusted_ips]